Dependency audit

Runtime and extra dependencies are declared in pyproject.toml. There is no lockfile in v1; CI installs current compatible wheels on each run.

Inventory (declared)

Extra / profile	Packages
Core	Pillow, pymupdf, wordcloud
[ui]	streamlit, pydantic, ebooklib
[export]	ebooklib
[dev]	pytest, pytest-cov, pytest-timeout, ruff + UI extras

Ollama is an external local service, not a Python dependency.

Audit practice

Before a public tag:

1. pip install -e '.[dev]' into a clean venv (or CI release-checks log).

2. Optionally pip-audit / GitHub Dependabot when enabled — record findings below.

3. Waive only with owner, expiry, and reason.

Waiver log

Date	Package	Advisory	Severity	Decision	Expiry	Owner
—	—	—	—	No open waivers	—	—

When adding a waiver, link the advisory and the release tag that accepted it.