GitHub repository

openai/openai-agents-python

https://github.com/openai/openai-agents-python (main)

Export SBOM

Import Notes 4 notes from dependency parsing

Scanned 4 dependency files in this repository.

Included 3 Python dependencies without an exact installed version; OSV matching requires a lockfile or exact pin.

Included 30 Python dependencies without an exact installed version; OSV matching requires a lockfile or exact pin.

Included 5 Python dependencies without an exact installed version; OSV matching requires a lockfile or exact pin.

14 Runtime Findings Confirmed in root/runtime dependency evidence

0 Non-Runtime Findings 0 critical/high packages in workspace, vendored, eval, test, docs, or unclear sources

31 Unverified Versions Inventoried, not counted as vulnerable

187 Clear Versions No OSV advisories for these exact package versions

Scan Diagnostics 14 affected versions · 37 advisories · 232 total package versions Show detailsHide details

232 Total Package Versions 14 confirmed affected, 31 unverified

4 Deepest Vulnerability Path dependency levels from the repository root

14 Runtime Candidate Findings 0 confirmed in non-runtime or unclear sources

9 Transitive Affected Packages 5 direct confirmed affected packages

5 Direct Affected Packages Closest fixes to prioritize first if exposure is runtime

9 Critical / High Packages 0 critical · 9 high across all exposure classes

Scanned Dependency Files 4 files · 146 transitive dependencies Show detailsHide details

The repository is the root. These files are the evidence sources used to build the aggregate dependency view.

uv.lock 201 components · 55 direct · 14 vulnerable

examples/realtime/twilio/requirements.txt 5 components · 5 direct · 0 vulnerable

examples/realtime/twilio_sip/requirements.txt 3 components · 3 direct · 0 vulnerable

pyproject.toml 31 components · 31 direct · 0 vulnerable

Vulnerability Monitor

14 confirmed affected package versions · 37 unique advisories · 5 confirmed affected direct dependencies · 31 unverified package versions

CRITICAL 0 HIGH 9 MEDIUM 4 LOW 1 UNKNOWN 0

Confirmed findings require package ecosystem, package name, and exact installed version. Exposure labels separate advisory severity from where the dependency evidence came from, such as runtime, workspace, test, docs, or vendored eval files.

High 9 packages · 31 advisories Packages whose highest matched advisory is high.

aiohttp 3.12.15 · PyPI · direct Runtime Candidate uv.lock direct dependency

18 graphs available for this package version Shown at confirmed high advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

HIGH Runtime Candidate 18 advisories

HIGH

GHSA-6mq8-rvhq-8wgg AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb Fixed: 3.13.3 · CVE-2025-69223 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

MEDIUM

GHSA-6jhg-hg63-jvvf AIOHTTP vulnerable to denial of service through large payloads Fixed: 3.13.3 · CVE-2025-69228 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

MEDIUM

GHSA-c427-h43c-vf67 AIOHTTP accepts duplicate Host headers Fixed: 3.13.4 · CVE-2026-34525 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

MEDIUM

GHSA-g84x-mcqj-x9qq AIOHTTP vulnerable to DoS through chunked messages Fixed: 3.13.3 · CVE-2025-69229 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

MEDIUM

GHSA-jj3x-wxrx-4x23 AIOHTTP vulnerable to DoS when bypassing asserts Fixed: 3.13.3 · CVE-2025-69227 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

MEDIUM

GHSA-m5qp-6w8w-w647 AIOHTTP has a Multipart Header Size Bypass Fixed: 3.13.4 · CVE-2026-34516 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

MEDIUM

GHSA-p998-jp59-783m AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows Fixed: 3.13.4 · CVE-2026-34515 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

MEDIUM

GHSA-w2fm-2cpv-w7v5 aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage Fixed: 3.13.4 · CVE-2026-22815 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-2vrm-gr82-f7m5 AIOHTTP has CRLF injection through multipart part content type header construction Fixed: 3.13.4 · CVE-2026-34514 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-3wq7-rqq7-wx6j AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS Fixed: 3.13.4 · CVE-2026-34517 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-54jq-c3m8-4m76 AIOHTTP vulnerable to brute-force leak of internal static ﬁle path components Fixed: 3.13.3 · CVE-2025-69226 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-63hf-3vf5-4wqf AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass Fixed: 3.13.4 · CVE-2026-34520 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-69f9-5gxw-wvc2 AIOHTTP's unicode processing of header values could cause parsing discrepancies Fixed: 3.13.3 · CVE-2025-69224 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-966j-vmvw-g2g9 AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect Fixed: 3.13.4 · CVE-2026-34518 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-fh55-r93g-j68g AIOHTTP Vulnerable to Cookie Parser Warning Storm Fixed: 3.13.3 · CVE-2025-69230 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-hcc4-c3v8-rx92 AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector Fixed: 3.13.4 · CVE-2026-34513 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-mqqc-3gqh-h2x8 AIOHTTP has unicode match groups in regexes for ASCII protocol elements Fixed: 3.13.3 · CVE-2025-69225 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

LOW

GHSA-mwh4-6h8g-pg8w AIOHTTP has HTTP response splitting via \r in reason phrase Fixed: 3.13.4 · CVE-2026-34519 · GitHub reviewed · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.

cryptography 45.0.7 · PyPI · direct Runtime Candidate uv.lock direct dependency

3 graphs available for this package version Shown at confirmed high advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

HIGH Runtime Candidate 3 advisories

litellm 1.83.0 · PyPI · direct Runtime Candidate uv.lock direct dependency

1 graph available for this package version Shown at confirmed high advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

HIGH Runtime Candidate 1 advisory

urllib3 2.5.0 · PyPI · transitive Runtime Candidate uv.lock transitive 2 levels deep

3 graphs available for this package version Shown at confirmed high advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

HIGH Runtime Candidate 3 advisories

Medium 4 packages · 5 advisories Packages whose highest matched advisory is medium.

pytest 8.4.1 · PyPI · direct Runtime Candidate uv.lock direct dependency

1 graph available for this package version Shown at confirmed medium advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

MEDIUM Runtime Candidate 1 advisory

requests 2.32.4 · PyPI · direct Runtime Candidate uv.lock direct dependency

1 graph available for this package version Shown at confirmed medium advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

MEDIUM Runtime Candidate 1 advisory

filelock 3.18.0 · PyPI · transitive Runtime Candidate uv.lock transitive 4 levels deep

2 graphs available for this package version Shown at confirmed medium advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

MEDIUM Runtime Candidate 2 advisories

Low and Unknown 1 packages · 1 advisories Packages with low or unknown advisory severity.

pygments 2.19.2 · PyPI · transitive Runtime Candidate uv.lock transitive 2 levels deep

1 graph available for this package version Shown at confirmed low advisory severity with runtime candidate exposure evidence. Choose a graph to inspect the specific advisory and path.

LOW Runtime Candidate 1 advisory

SBOM Manifest

14 confirmed affected package versions, 31 unverified package versions, 187 clear package versions.

45 review rows · 187 clear hidden Show tableHide table

Component	Version	Ecosystem	Scope	Exposure	Source	Package URL	Status
aiohttp	3.12.15	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/aiohttp@3.12.15	HIGH 18 exact-version OSV advisories
Choose a graph for aiohttp@3.12.15 18 advisories HIGH GHSA-6mq8-rvhq-8wgg AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-6jhg-hg63-jvvf AIOHTTP vulnerable to denial of service through large payloads Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-c427-h43c-vf67 AIOHTTP accepts duplicate Host headers Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-g84x-mcqj-x9qq AIOHTTP vulnerable to DoS through chunked messages Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-jj3x-wxrx-4x23 AIOHTTP vulnerable to DoS when bypassing asserts Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-m5qp-6w8w-w647 AIOHTTP has a Multipart Header Size Bypass Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-p998-jp59-783m AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-w2fm-2cpv-w7v5 aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-2vrm-gr82-f7m5 AIOHTTP has CRLF injection through multipart part content type header construction Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-3wq7-rqq7-wx6j AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-54jq-c3m8-4m76 AIOHTTP vulnerable to brute-force leak of internal static ﬁle path components Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-63hf-3vf5-4wqf AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-69f9-5gxw-wvc2 AIOHTTP's unicode processing of header values could cause parsing discrepancies Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-966j-vmvw-g2g9 AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-fh55-r93g-j68g AIOHTTP Vulnerable to Cookie Parser Warning Storm Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-hcc4-c3v8-rx92 AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-mqqc-3gqh-h2x8 AIOHTTP has unicode match groups in regexes for ASCII protocol elements Fixed: 3.13.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-mwh4-6h8g-pg8w AIOHTTP has HTTP response splitting via \r in reason phrase Fixed: 3.13.4 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
cryptography	45.0.7	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/cryptography@45.0.7	HIGH 3 exact-version OSV advisories
Choose a graph for cryptography@45.0.7 3 advisories HIGH GHSA-r6ph-v2qm-q3c2 cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves Fixed: 46.0.5 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-p423-j2cm-9vmq Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs Fixed: 46.0.7 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. LOW GHSA-m959-cc7f-wv43 cryptography has incomplete DNS name constraint enforcement on peer names Fixed: 46.0.6 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
litellm	1.83.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/litellm@1.83.0	HIGH 1 exact-version OSV advisory
Choose a graph for litellm@1.83.0 1 advisory HIGH GHSA-xqmj-j6mv-4862 LiteLLM: Server-Side Template Injection in /prompts/test endpoint Fixed: 1.83.7 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
cbor2	5.8.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/cbor2@5.8.0	HIGH 1 exact-version OSV advisory
Choose a graph for cbor2@5.8.0 1 advisory HIGH GHSA-3c37-wwvx-h642 cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads Fixed: 5.9.0 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
protobuf	5.29.5	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/protobuf@5.29.5	HIGH 1 exact-version OSV advisory
Choose a graph for protobuf@5.29.5 1 advisory HIGH GHSA-7gcm-g887-7qv7 protobuf affected by a JSON recursion depth bypass Fixed: 5.29.6 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
pyjwt	2.10.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyjwt@2.10.1	HIGH 1 exact-version OSV advisory
Choose a graph for pyjwt@2.10.1 1 advisory HIGH GHSA-752w-5fwx-jx9f PyJWT accepts unknown `crit` header extensions Fixed: 2.12.0 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
python-multipart	0.0.20	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/python-multipart@0.0.20	HIGH 2 exact-version OSV advisories
Choose a graph for python-multipart@0.0.20 2 advisories HIGH GHSA-wp53-j4wj-2cfg Python-Multipart has Arbitrary File Write via Non-Default Configuration Fixed: 0.0.22 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-mj87-hwqh-73pj python-multipart affected by Denial of Service via large multipart preamble or epilogue data Fixed: 0.0.26 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
starlette	0.47.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/starlette@0.47.2	HIGH 1 exact-version OSV advisory
Choose a graph for starlette@0.47.2 1 advisory HIGH GHSA-7f5h-v6xp-fcq8 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` Fixed: 0.49.1 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
urllib3	2.5.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/urllib3@2.5.0	HIGH 3 exact-version OSV advisories
Choose a graph for urllib3@2.5.0 3 advisories HIGH GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data Fixed: 2.6.0 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. HIGH GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) Fixed: 2.6.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. HIGH GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain Fixed: 2.6.0 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
pytest	8.4.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pytest@8.4.1	MEDIUM 1 exact-version OSV advisory
Choose a graph for pytest@8.4.1 1 advisory MEDIUM GHSA-6w46-j5rx-g56g pytest has vulnerable tmpdir handling Fixed: 9.0.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
requests	2.32.4	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/requests@2.32.4	MEDIUM 1 exact-version OSV advisory
Choose a graph for requests@2.32.4 1 advisory MEDIUM GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function Fixed: 2.33.0 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
filelock	3.18.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/filelock@3.18.0	MEDIUM 2 exact-version OSV advisories
Choose a graph for filelock@3.18.0 2 advisories MEDIUM GHSA-qmgc-5h2g-mvrw filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock Fixed: 3.20.3 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise. MEDIUM GHSA-w853-jp5j-5j7f filelock has a TOCTOU race condition which allows symlink attacks during lock file creation Fixed: 3.20.1 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
python-dotenv	1.1.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/python-dotenv@1.1.1	MEDIUM 1 exact-version OSV advisory
Choose a graph for python-dotenv@1.1.1 1 advisory MEDIUM GHSA-mf9w-mj56-hr94 python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback Fixed: 1.2.2 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
pygments	2.19.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pygments@2.19.2	LOW 1 exact-version OSV advisory
Choose a graph for pygments@2.19.2 1 advisory LOW GHSA-5239-wwwm-4pmq Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching Fixed: 2.20.0 · Root dependency evidence; likely installed for normal use unless package metadata says otherwise.
websockets		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	2 files examples/realtime/twilio/requirements.txt pyproject.toml	pkg:pypi/websockets	Unverified No exact installed version; not treated as vulnerable
openai		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	2 files examples/realtime/twilio_sip/requirements.txt pyproject.toml	pkg:pypi/openai	Unverified No exact installed version; not treated as vulnerable
aiohttp		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/aiohttp	Unverified No exact installed version; not treated as vulnerable
any-llm-sdk		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/any-llm-sdk	Unverified No exact installed version; not treated as vulnerable
asyncpg		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/asyncpg	Unverified No exact installed version; not treated as vulnerable
blaxel		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/blaxel	Unverified No exact installed version; not treated as vulnerable
boto3		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/boto3	Unverified No exact installed version; not treated as vulnerable
cryptography		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/cryptography	Unverified No exact installed version; not treated as vulnerable
dapr		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/dapr	Unverified No exact installed version; not treated as vulnerable
daytona		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/daytona	Unverified No exact installed version; not treated as vulnerable
docker		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/docker	Unverified No exact installed version; not treated as vulnerable
graphviz		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/graphviz	Unverified No exact installed version; not treated as vulnerable
griffelib		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/griffelib	Unverified No exact installed version; not treated as vulnerable
grpcio		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/grpcio	Unverified No exact installed version; not treated as vulnerable
litellm		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/litellm	Unverified No exact installed version; not treated as vulnerable
mcp		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/mcp	Unverified No exact installed version; not treated as vulnerable
numpy		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/numpy	Unverified No exact installed version; not treated as vulnerable
pydantic		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/pydantic	Unverified No exact installed version; not treated as vulnerable
pymongo		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/pymongo	Unverified No exact installed version; not treated as vulnerable
redis		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/redis	Unverified No exact installed version; not treated as vulnerable
requests		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/requests	Unverified No exact installed version; not treated as vulnerable
runloop-api-client		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/runloop-api-client	Unverified No exact installed version; not treated as vulnerable
sqlalchemy		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/sqlalchemy	Unverified No exact installed version; not treated as vulnerable
textual		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/textual	Unverified No exact installed version; not treated as vulnerable
types-requests		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/types-requests	Unverified No exact installed version; not treated as vulnerable
typing-extensions		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/typing-extensions	Unverified No exact installed version; not treated as vulnerable
vercel		PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	pyproject.toml	pkg:pypi/vercel	Unverified No exact installed version; not treated as vulnerable
fastapi		PyPI	Direct	Example/Demo Example or demo dependency; not assumed to be part of normal runtime install.	2 files examples/realtime/twilio/requirements.txt examples/realtime/twilio_sip/requirements.txt	pkg:pypi/fastapi	Unverified No exact installed version; not treated as vulnerable
openai-agents		PyPI	Direct	Example/Demo Example or demo dependency; not assumed to be part of normal runtime install.	examples/realtime/twilio/requirements.txt	pkg:pypi/openai-agents	Unverified No exact installed version; not treated as vulnerable
python-dotenv		PyPI	Direct	Example/Demo Example or demo dependency; not assumed to be part of normal runtime install.	examples/realtime/twilio/requirements.txt	pkg:pypi/python-dotenv	Unverified No exact installed version; not treated as vulnerable
uvicorn		PyPI	Direct	Example/Demo Example or demo dependency; not assumed to be part of normal runtime install.	2 files examples/realtime/twilio/requirements.txt examples/realtime/twilio_sip/requirements.txt	pkg:pypi/uvicorn	Unverified No exact installed version; not treated as vulnerable

Clear Dependencies 187 packages hidden Show clear packagesHide clear packages

Component	Version	Ecosystem	Scope	Exposure	Source	Package URL	Status
e2b	2.20.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	2 files pyproject.toml uv.lock	pkg:pypi/e2b@2.20.0	Clear No OSV advisories for this exact version
e2b-code-interpreter	2.4.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	2 files pyproject.toml uv.lock	pkg:pypi/e2b-code-interpreter@2.4.1	Clear No OSV advisories for this exact version
modal	1.3.5	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	2 files pyproject.toml uv.lock	pkg:pypi/modal@1.3.5	Clear No OSV advisories for this exact version
temporalio	1.26.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	2 files pyproject.toml uv.lock	pkg:pypi/temporalio@1.26.0	Clear No OSV advisories for this exact version
aiosqlite	0.21.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/aiosqlite@0.21.0	Clear No OSV advisories for this exact version
any-llm-sdk	1.11.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/any-llm-sdk@1.11.0	Clear No OSV advisories for this exact version
asyncpg	0.30.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/asyncpg@0.30.0	Clear No OSV advisories for this exact version
blaxel	0.2.50	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/blaxel@0.2.50	Clear No OSV advisories for this exact version
boto3	1.42.75	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/boto3@1.42.75	Clear No OSV advisories for this exact version
coverage	7.10.3	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/coverage@7.10.3	Clear No OSV advisories for this exact version
dapr	1.16.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/dapr@1.16.0	Clear No OSV advisories for this exact version
daytona	0.155.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/daytona@0.155.0	Clear No OSV advisories for this exact version
docker	7.1.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/docker@7.1.0	Clear No OSV advisories for this exact version
eval-type-backport	0.2.2	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/eval-type-backport@0.2.2	Clear No OSV advisories for this exact version
fakeredis	2.31.3	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/fakeredis@2.31.3	Clear No OSV advisories for this exact version
fastapi	0.116.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/fastapi@0.116.1	Clear No OSV advisories for this exact version
graphviz	0.21	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/graphviz@0.21	Clear No OSV advisories for this exact version
griffelib	2.0.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/griffelib@2.0.1	Clear No OSV advisories for this exact version
grpcio	1.76.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/grpcio@1.76.0	Clear No OSV advisories for this exact version
inline-snapshot	0.27.2	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/inline-snapshot@0.27.2	Clear No OSV advisories for this exact version
mcp	1.26.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mcp@1.26.0	Clear No OSV advisories for this exact version
mkdocs	1.6.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocs@1.6.1	Clear No OSV advisories for this exact version
mkdocs-material	9.6.16	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocs-material@9.6.16	Clear No OSV advisories for this exact version
mkdocs-static-i18n	1.3.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocs-static-i18n@1.3.0	Clear No OSV advisories for this exact version
mkdocstrings	1.0.3	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocstrings@1.0.3	Clear No OSV advisories for this exact version
mypy	1.17.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mypy@1.17.1	Clear No OSV advisories for this exact version
numpy	2.2.6	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/numpy@2.2.6	Clear No OSV advisories for this exact version
numpy	2.3.2	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/numpy@2.3.2	Clear No OSV advisories for this exact version
openai	2.26.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/openai@2.26.0	Clear No OSV advisories for this exact version
playwright	1.50.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/playwright@1.50.0	Clear No OSV advisories for this exact version
pydantic	2.12.3	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pydantic@2.12.3	Clear No OSV advisories for this exact version
pymongo	4.16.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pymongo@4.16.0	Clear No OSV advisories for this exact version
pynput	1.8.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pynput@1.8.1	Clear No OSV advisories for this exact version
pyright	1.1.408	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyright@1.1.408	Clear No OSV advisories for this exact version
pytest-asyncio	1.1.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pytest-asyncio@1.1.0	Clear No OSV advisories for this exact version
pytest-mock	3.14.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pytest-mock@3.14.1	Clear No OSV advisories for this exact version
pytest-xdist	3.8.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pytest-xdist@3.8.0	Clear No OSV advisories for this exact version
redis	7.0.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/redis@7.0.1	Clear No OSV advisories for this exact version
rich	14.3.3	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/rich@14.3.3	Clear No OSV advisories for this exact version
ruff	0.9.2	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/ruff@0.9.2	Clear No OSV advisories for this exact version
runloop-api-client	1.16.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/runloop-api-client@1.16.0	Clear No OSV advisories for this exact version
sounddevice	0.5.2	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/sounddevice@0.5.2	Clear No OSV advisories for this exact version
sqlalchemy	2.0.43	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/sqlalchemy@2.0.43	Clear No OSV advisories for this exact version
testcontainers	4.12.0	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/testcontainers@4.12.0	Clear No OSV advisories for this exact version
textual	8.2.3	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/textual@8.2.3	Clear No OSV advisories for this exact version
types-pynput	1.8.1.20250809	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/types-pynput@1.8.1.20250809	Clear No OSV advisories for this exact version
types-requests	2.32.4.20250809	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/types-requests@2.32.4.20250809	Clear No OSV advisories for this exact version
typing-extensions	4.14.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/typing-extensions@4.14.1	Clear No OSV advisories for this exact version
vercel	0.5.6	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/vercel@0.5.6	Clear No OSV advisories for this exact version
websockets	15.0.1	PyPI	Direct	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/websockets@15.0.1	Clear No OSV advisories for this exact version
aiofiles	24.1.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/aiofiles@24.1.0	Clear No OSV advisories for this exact version
aiohappyeyeballs	2.6.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/aiohappyeyeballs@2.6.1	Clear No OSV advisories for this exact version
aiohttp-retry	2.9.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/aiohttp-retry@2.9.1	Clear No OSV advisories for this exact version
aiosignal	1.4.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/aiosignal@1.4.0	Clear No OSV advisories for this exact version
annotated-doc	0.0.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/annotated-doc@0.0.4	Clear No OSV advisories for this exact version
annotated-types	0.7.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/annotated-types@0.7.0	Clear No OSV advisories for this exact version
anyio	4.10.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/anyio@4.10.0	Clear No OSV advisories for this exact version
asttokens	3.0.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/asttokens@3.0.0	Clear No OSV advisories for this exact version
async-timeout	5.0.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/async-timeout@5.0.1	Clear No OSV advisories for this exact version
attrs	25.3.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/attrs@25.3.0	Clear No OSV advisories for this exact version
babel	2.17.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/babel@2.17.0	Clear No OSV advisories for this exact version
backports-asyncio-runner	1.2.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/backports-asyncio-runner@1.2.0	Clear No OSV advisories for this exact version
backports-datetime-fromisoformat	2.0.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/backports-datetime-fromisoformat@2.0.3	Clear No OSV advisories for this exact version
backrefs	5.9	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/backrefs@5.9	Clear No OSV advisories for this exact version
botocore	1.42.75	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/botocore@1.42.75	Clear No OSV advisories for this exact version
bracex	2.6	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/bracex@2.6	Clear No OSV advisories for this exact version
certifi	2025.8.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/certifi@2025.8.3	Clear No OSV advisories for this exact version
cffi	1.17.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/cffi@1.17.1	Clear No OSV advisories for this exact version
charset-normalizer	3.4.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/charset-normalizer@3.4.3	Clear No OSV advisories for this exact version
click	8.2.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/click@8.2.1	Clear No OSV advisories for this exact version
colorama	0.4.6	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/colorama@0.4.6	Clear No OSV advisories for this exact version
daytona-api-client	0.155.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/daytona-api-client@0.155.0	Clear No OSV advisories for this exact version
daytona-api-client-async	0.155.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/daytona-api-client-async@0.155.0	Clear No OSV advisories for this exact version
daytona-toolbox-api-client	0.155.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/daytona-toolbox-api-client@0.155.0	Clear No OSV advisories for this exact version
daytona-toolbox-api-client-async	0.155.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/daytona-toolbox-api-client-async@0.155.0	Clear No OSV advisories for this exact version
deprecated	1.3.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/deprecated@1.3.1	Clear No OSV advisories for this exact version
distro	1.9.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/distro@1.9.0	Clear No OSV advisories for this exact version
dnspython	2.8.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/dnspython@2.8.0	Clear No OSV advisories for this exact version
dockerfile-parse	2.0.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/dockerfile-parse@2.0.1	Clear No OSV advisories for this exact version
environs	14.6.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/environs@14.6.0	Clear No OSV advisories for this exact version
evdev	1.9.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/evdev@1.9.2	Clear No OSV advisories for this exact version
exceptiongroup	1.3.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/exceptiongroup@1.3.1	Clear No OSV advisories for this exact version
execnet	2.1.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/execnet@2.1.2	Clear No OSV advisories for this exact version
executing	2.2.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/executing@2.2.0	Clear No OSV advisories for this exact version
fastuuid	0.14.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/fastuuid@0.14.0	Clear No OSV advisories for this exact version
frozenlist	1.7.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/frozenlist@1.7.0	Clear No OSV advisories for this exact version
fsspec	2025.7.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/fsspec@2025.7.0	Clear No OSV advisories for this exact version
ghp-import	2.1.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/ghp-import@2.1.0	Clear No OSV advisories for this exact version
googleapis-common-protos	1.70.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/googleapis-common-protos@1.70.0	Clear No OSV advisories for this exact version
greenlet	3.2.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/greenlet@3.2.4	Clear No OSV advisories for this exact version
grpcio-status	1.67.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/grpcio-status@1.67.1	Clear No OSV advisories for this exact version
grpclib	0.4.9	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/grpclib@0.4.9	Clear No OSV advisories for this exact version
h11	0.16.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/h11@0.16.0	Clear No OSV advisories for this exact version
h2	4.3.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/h2@4.3.0	Clear No OSV advisories for this exact version
hf-xet	1.1.7	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/hf-xet@1.1.7	Clear No OSV advisories for this exact version
hpack	4.1.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/hpack@4.1.0	Clear No OSV advisories for this exact version
httpcore	1.0.9	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/httpcore@1.0.9	Clear No OSV advisories for this exact version
httpx	0.28.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/httpx@0.28.1	Clear No OSV advisories for this exact version
httpx-sse	0.4.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/httpx-sse@0.4.1	Clear No OSV advisories for this exact version
huggingface-hub	0.34.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/huggingface-hub@0.34.4	Clear No OSV advisories for this exact version
hyperframe	6.1.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/hyperframe@6.1.0	Clear No OSV advisories for this exact version
idna	3.10	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/idna@3.10	Clear No OSV advisories for this exact version
importlib-metadata	8.7.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/importlib-metadata@8.7.0	Clear No OSV advisories for this exact version
iniconfig	2.1.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/iniconfig@2.1.0	Clear No OSV advisories for this exact version
jinja2	3.1.6	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/jinja2@3.1.6	Clear No OSV advisories for this exact version
jiter	0.10.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/jiter@0.10.0	Clear No OSV advisories for this exact version
jmespath	1.1.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/jmespath@1.1.0	Clear No OSV advisories for this exact version
jsonschema	4.25.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/jsonschema@4.25.0	Clear No OSV advisories for this exact version
jsonschema-specifications	2025.4.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/jsonschema-specifications@2025.4.1	Clear No OSV advisories for this exact version
linkify-it-py	2.0.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/linkify-it-py@2.0.3	Clear No OSV advisories for this exact version
markdown	3.8.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/markdown@3.8.2	Clear No OSV advisories for this exact version
markdown-it-py	4.0.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/markdown-it-py@4.0.0	Clear No OSV advisories for this exact version
markupsafe	3.0.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/markupsafe@3.0.2	Clear No OSV advisories for this exact version
marshmallow	4.2.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/marshmallow@4.2.2	Clear No OSV advisories for this exact version
mdit-py-plugins	0.5.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mdit-py-plugins@0.5.0	Clear No OSV advisories for this exact version
mdurl	0.1.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mdurl@0.1.2	Clear No OSV advisories for this exact version
mergedeep	1.3.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mergedeep@1.3.4	Clear No OSV advisories for this exact version
mkdocs-autorefs	1.4.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocs-autorefs@1.4.2	Clear No OSV advisories for this exact version
mkdocs-get-deps	0.2.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocs-get-deps@0.2.0	Clear No OSV advisories for this exact version
mkdocs-material-extensions	1.3.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocs-material-extensions@1.3.1	Clear No OSV advisories for this exact version
mkdocstrings-python	2.0.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mkdocstrings-python@2.0.3	Clear No OSV advisories for this exact version
multidict	6.6.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/multidict@6.6.4	Clear No OSV advisories for this exact version
mypy-extensions	1.1.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/mypy-extensions@1.1.0	Clear No OSV advisories for this exact version
nexus-rpc	1.4.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/nexus-rpc@1.4.0	Clear No OSV advisories for this exact version
nodeenv	1.10.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/nodeenv@1.10.0	Clear No OSV advisories for this exact version
obstore	0.8.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/obstore@0.8.2	Clear No OSV advisories for this exact version
openresponses-types	2.3.0.post1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/openresponses-types@2.3.0.post1	Clear No OSV advisories for this exact version
opentelemetry-api	1.40.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-api@1.40.0	Clear No OSV advisories for this exact version
opentelemetry-exporter-otlp-proto-common	1.40.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-exporter-otlp-proto-common@1.40.0	Clear No OSV advisories for this exact version
opentelemetry-exporter-otlp-proto-http	1.40.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-exporter-otlp-proto-http@1.40.0	Clear No OSV advisories for this exact version
opentelemetry-instrumentation	0.61b0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-instrumentation@0.61b0	Clear No OSV advisories for this exact version
opentelemetry-instrumentation-aiohttp-client	0.61b0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-instrumentation-aiohttp-client@0.61b0	Clear No OSV advisories for this exact version
opentelemetry-proto	1.40.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-proto@1.40.0	Clear No OSV advisories for this exact version
opentelemetry-sdk	1.40.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-sdk@1.40.0	Clear No OSV advisories for this exact version
opentelemetry-semantic-conventions	0.61b0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-semantic-conventions@0.61b0	Clear No OSV advisories for this exact version
opentelemetry-util-http	0.61b0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/opentelemetry-util-http@0.61b0	Clear No OSV advisories for this exact version
packaging	25.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/packaging@25.0	Clear No OSV advisories for this exact version
paginate	0.5.7	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/paginate@0.5.7	Clear No OSV advisories for this exact version
pathspec	0.12.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pathspec@0.12.1	Clear No OSV advisories for this exact version
platformdirs	4.3.8	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/platformdirs@4.3.8	Clear No OSV advisories for this exact version
pluggy	1.6.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pluggy@1.6.0	Clear No OSV advisories for this exact version
propcache	0.3.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/propcache@0.3.2	Clear No OSV advisories for this exact version
pycparser	2.22	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pycparser@2.22	Clear No OSV advisories for this exact version
pydantic-core	2.41.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pydantic-core@2.41.4	Clear No OSV advisories for this exact version
pydantic-settings	2.10.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pydantic-settings@2.10.1	Clear No OSV advisories for this exact version
pyee	12.1.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyee@12.1.1	Clear No OSV advisories for this exact version
pymdown-extensions	10.16.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pymdown-extensions@10.16.1	Clear No OSV advisories for this exact version
pyobjc-core	11.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyobjc-core@11.1	Clear No OSV advisories for this exact version
pyobjc-framework-applicationservices	11.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyobjc-framework-applicationservices@11.1	Clear No OSV advisories for this exact version
pyobjc-framework-cocoa	11.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyobjc-framework-cocoa@11.1	Clear No OSV advisories for this exact version
pyobjc-framework-coretext	11.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyobjc-framework-coretext@11.1	Clear No OSV advisories for this exact version
pyobjc-framework-quartz	11.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyobjc-framework-quartz@11.1	Clear No OSV advisories for this exact version
python-dateutil	2.9.0.post0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/python-dateutil@2.9.0.post0	Clear No OSV advisories for this exact version
python-xlib	0.33	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/python-xlib@0.33	Clear No OSV advisories for this exact version
pywin32	311	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pywin32@311	Clear No OSV advisories for this exact version
pyyaml	6.0.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyyaml@6.0.2	Clear No OSV advisories for this exact version
pyyaml-env-tag	1.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/pyyaml-env-tag@1.1	Clear No OSV advisories for this exact version
referencing	0.36.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/referencing@0.36.2	Clear No OSV advisories for this exact version
regex	2025.7.34	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/regex@2025.7.34	Clear No OSV advisories for this exact version
rpds-py	0.27.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/rpds-py@0.27.0	Clear No OSV advisories for this exact version
s3transfer	0.16.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/s3transfer@0.16.0	Clear No OSV advisories for this exact version
shellingham	1.5.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/shellingham@1.5.4	Clear No OSV advisories for this exact version
six	1.17.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/six@1.17.0	Clear No OSV advisories for this exact version
sniffio	1.3.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/sniffio@1.3.1	Clear No OSV advisories for this exact version
sortedcontainers	2.4.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/sortedcontainers@2.4.0	Clear No OSV advisories for this exact version
sse-starlette	3.0.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/sse-starlette@3.0.2	Clear No OSV advisories for this exact version
synchronicity	0.11.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/synchronicity@0.11.1	Clear No OSV advisories for this exact version
tiktoken	0.12.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/tiktoken@0.12.0	Clear No OSV advisories for this exact version
tokenizers	0.21.4	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/tokenizers@0.21.4	Clear No OSV advisories for this exact version
toml	0.10.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/toml@0.10.2	Clear No OSV advisories for this exact version
tomli	2.2.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/tomli@2.2.1	Clear No OSV advisories for this exact version
tqdm	4.67.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/tqdm@4.67.1	Clear No OSV advisories for this exact version
typer	0.24.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/typer@0.24.1	Clear No OSV advisories for this exact version
types-certifi	2021.10.8.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/types-certifi@2021.10.8.3	Clear No OSV advisories for this exact version
types-protobuf	6.32.1.20260221	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/types-protobuf@6.32.1.20260221	Clear No OSV advisories for this exact version
types-toml	0.10.8.20240310	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/types-toml@0.10.8.20240310	Clear No OSV advisories for this exact version
typing-inspection	0.4.2	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/typing-inspection@0.4.2	Clear No OSV advisories for this exact version
uc-micro-py	1.0.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/uc-micro-py@1.0.3	Clear No OSV advisories for this exact version
uuid-utils	0.14.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/uuid-utils@0.14.1	Clear No OSV advisories for this exact version
uvicorn	0.35.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/uvicorn@0.35.0	Clear No OSV advisories for this exact version
vercel-workers	0.0.16	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/vercel-workers@0.0.16	Clear No OSV advisories for this exact version
watchdog	6.0.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/watchdog@6.0.0	Clear No OSV advisories for this exact version
watchfiles	1.1.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/watchfiles@1.1.1	Clear No OSV advisories for this exact version
wcmatch	10.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/wcmatch@10.1	Clear No OSV advisories for this exact version
wrapt	1.17.3	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/wrapt@1.17.3	Clear No OSV advisories for this exact version
yarl	1.20.1	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/yarl@1.20.1	Clear No OSV advisories for this exact version
zipp	3.23.0	PyPI	Transitive	Runtime Candidate Root dependency evidence; likely installed for normal use unless package metadata says otherwise.	uv.lock	pkg:pypi/zipp@3.23.0	Clear No OSV advisories for this exact version