chore: Pin all Python dependencies to prevent unexpected breaking changes

[thesubtleties]

Background

We got bit by an unpinned minio dependency - version 7.2.19 (released Nov 24) introduced a breaking API change that broke all image uploads in production. Thankfully 7.2.20 (Nov 27) reverted it, but we got lucky.

See #342 for the full post-mortem.

Task

Pin all Python dependencies in backend/atria/requirements.txt to specific versions to prevent surprise breaking changes.

Approach

1. Generate current working versions:

   docker exec atria-backend-1 pip freeze > requirements.frozen.txt

2. Update requirements.txt with pinned versions (either exact pins or compatible release operators):

   # Exact pin (safest)
   minio==7.2.18
   
   # Or compatible release (allows patch updates)
   minio~=7.2.18
   

3. Consider setting up a process for periodic dependency updates (Dependabot, manual quarterly review, etc.)

Files to Update

• backend/atria/requirements.txt

Future Considerations

• Set up Dependabot for automated PRs on dependency updates
• Or establish a manual review cadence (monthly/quarterly)
• Consider separate requirements.txt (direct deps) and requirements.lock (full freeze)