# Pinned deliberately, and shipped INSIDE the bundle so the sha256 covers them.
#
# The first thing this toolkit asks of a client's backtest is "does it reproduce?". Running the
# instruments themselves on whatever numpy and pandas a distro happens to ship would be the same
# defect one layer up: apt on Ubuntu 24.04 gives pandas 2.x, these were written and self-tested
# against pandas 3.x, and a changed groupby default or copy-on-write rule moves a number quietly.
#
# These are the versions selftest_all.py passes 6/6 under. If you change them, re-run the selftest
# and ship a new bundle version -- do not edit this file in place on an engagement box.
numpy==2.5.1
pandas==3.0.3

# pyarrow was an UNPINNED dependency through v4 and should not have been: pandas 3.0.3 does not
# require it (`Requires: numpy, python-dateutil`), but fc4_concentration.py calls pd.read_parquet,
# which does. A box without it failed at the point of reading the client's data, not at install.
pyarrow==25.0.1

# NEW IN v5 -- what makes a RED (tick / L2) engagement possible at all. The instruments used to
# need the whole column in RAM; fcdata.py asks the same questions as streaming SQL instead.
# The two paths must agree exactly, and selftest_ooc.py is the gate that proves it before the
# bundle is allowed to build.
duckdb==1.5.5
