chore(deps): lock pandas to 2.3.3 and add upper bounds

pyproject.toml

@@ -22,36 +22,37 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
 ]
 
-# Note: Using minimum version pins (>=) to allow automatic security updates.
+# Note: Use bounded ranges (>=,<) to avoid accidental major-version breaks.
 # For reproducible builds, use: pip freeze > requirements.lock
 dependencies = [
     # Core Framework
-    "flask>=3.0.0",
+    "flask>=3.0.0,<4.0.0",
 
     # Database
-    "oracledb>=2.0.0",
-    "sqlalchemy>=2.0.0",
+    "oracledb>=2.0.0,<4.0.0",
+    "sqlalchemy>=2.0.0,<3.0.0",
 
     # Data Processing
-    "pandas>=2.0.0",
+    # Pin pandas to a DBAPI2-compatible release for current pd.read_sql flow.
+    "pandas==2.3.3",
     "openpyxl>=3.0.0",
 
     # Cache (Redis)
-    "redis>=5.0.0",
-    "hiredis>=2.0.0",
+    "redis>=5.0.0,<6.0.0",
+    "hiredis>=2.0.0,<4.0.0",
 
     # HTTP Client
-    "requests>=2.28.0",
+    "requests>=2.28.0,<3.0.0",
 
     # Configuration
-    "python-dotenv>=1.0.0",
+    "python-dotenv>=1.0.0,<2.0.0",
 
     # WSGI Server
-    "gunicorn>=21.2.0",
-    "waitress>=2.1.2; platform_system == 'Windows'",
+    "gunicorn>=21.2.0,<25.0.0",
+    "waitress>=2.1.2,<4.0.0; platform_system == 'Windows'",
 
     # System Monitoring
-    "psutil>=5.9.0",
+    "psutil>=5.9.0,<7.0.0",
 ]
 
 [project.optional-dependencies]