# Waveline shipped dependencies (bundled inside the exe by build_app.py).
# Pinned after the 2026-09-23 security sweep; pip-audit gates releases
# against this file (release.py _dependency_vuln_gate).  Update = fix or
# bump, then re-run the audit - never ship with a known CVE here.
numpy==1.26.4
sounddevice>=0.4.6
mutagen>=1.47.0
