鎖定 requirements 最低版本

requirements.txt

@@ -1,31 +1,31 @@
 Flask>=2.3
-Flask-WTF
+Flask-WTF>=1.2.2
 gunicorn>=20.1
 pandas>=1.5
-pytz
-openpyxl
+pytz>=2026.2
+openpyxl>=3.1.5
 SQLAlchemy>=1.4
 psycopg2-binary>=2.9
-schedule
-pyngrok
-selenium
-requests
-numpy
-python-dotenv
-google-auth
-google-auth-oauthlib
-google-auth-httplib2
-google-api-python-client
-google-generativeai
+schedule>=1.2.2
+pyngrok>=8.1.2
+selenium>=4.36.0
+requests>=2.32.5
+numpy>=2.0.2
+python-dotenv>=1.2.1
+google-auth>=2.50.0
+google-auth-oauthlib>=1.3.1
+google-auth-httplib2>=0.3.1
+google-api-python-client>=2.196.0
+google-generativeai>=0.8.6
 anthropic>=0.40.0      # Phase 7 Frontier 升級：Claude Opus 4.7 Code Review（feature flag CODE_REVIEW_USE_CLAUDE 預設 OFF）
-feedparser
-beautifulsoup4
-lxml
-prometheus-client
+feedparser>=6.0.12
+beautifulsoup4>=4.14.3
+lxml>=6.1.0
+prometheus-client>=0.25.0
 python-telegram-bot[job-queue]>=20.0
 pgvector>=0.2
-paramiko               # ADR-013: AIOps SSH 跳板修復
-python-pptx            # ADR-014: PPT 簡報系統
-matplotlib             # 圖表生成（日報/週報/月報）
-matplotlib-inline      # Jupyter 相容層（可選）
-psutil>=5.9            # ADR-019 Phase 2: ElephantAlpha system load 真實量測（production 必裝；缺失時 fallback 為 queue-based 估算）
+paramiko>=5.0.0        # ADR-013: AIOps SSH 跳板修復
+python-pptx>=1.0.2     # ADR-014: PPT 簡報系統
+matplotlib>=3.9.4      # 圖表生成（日報/週報/月報）
+matplotlib-inline>=0.2.2  # Jupyter 相容層（可選）
+psutil>=5.9            # ADR-019 Phase 2: ElephantAlpha system load 真實量測（production 必裝；缺失時 fallback 為 queue-based 估算）

tests/test_requirements_pinning.py

@@ -0,0 +1,24 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _strip_inline_comment(line: str) -> str:
+    return line.split("#", 1)[0].strip()
+
+
+def test_requirements_have_version_specifiers():
+    unpinned = []
+    for raw_line in (ROOT / "requirements.txt").read_text(encoding="utf-8").splitlines():
+        line = _strip_inline_comment(raw_line)
+        if not line:
+            continue
+        if line.startswith(("-", "--")):
+            continue
+        if "@" in line:
+            continue
+        if not any(op in line for op in ("==", ">=", "<=", "~=", "!=", ">")):
+            unpinned.append(line)
+
+    assert unpinned == []