Fix installer dependency resolution and refresh lockfile

memory-update.md

@@ -59,3 +59,18 @@
 - Added regression tests for these cases in:
   - `src/tests/test_settings_menu.py`
   - `src/tests/test_cli_export_import.py`
+
+## Installer Dependency Resolution Fix (2026-02-26)
+- Root cause of installer failures was a stale `requirements.lock` pin (`cffi==1.17.1`) conflicting with `pynacl==1.6.2` (requires `cffi>=2.0.0` on Python >=3.9).
+- A second hidden source issue blocked clean lock regeneration: `starlette>=0.49.1` was incompatible with `fastapi>=0.110` resolution path (current fastapi metadata requires `starlette<0.48`).
+- Updated dependency sources to consistent constraints:
+  - `src/requirements.txt`: `starlette>=0.40,<0.48`
+  - `src/runtime_requirements.txt`: `starlette>=0.40,<0.48`
+  - `pyproject.toml`: `starlette = ">=0.40,<0.48"`
+- Regenerated `requirements.lock` with hashes; key resolved pins now include:
+  - `cffi==2.0.0`
+  - `pynacl==1.6.2`
+  - `fastapi==0.116.1`
+  - `starlette==0.47.3`
+- Verified the installer-critical step succeeds in a fresh virtualenv:
+  - `python -m pip install --require-hashes -r requirements.lock`

pyproject.toml

@@ -37,7 +37,7 @@ slowapi = "^0.1.9"
 cbor2 = ">=5.8.0"
 pynacl = ">=1.6.2"
 pyasn1 = ">=0.6.2"
-starlette = ">=0.49.1"
+starlette = ">=0.40,<0.48"
 urllib3 = ">=2.6.0"
 toga-core = { version = ">=0.5.2", optional = true }
 pillow = { version = ">=12.1.1", optional = true }
@@ -115,4 +115,3 @@ license = { file = "LICENSE" }
 [build-system]
 requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
-

src/requirements.txt

@@ -33,7 +33,7 @@ pyperclip>=1.9,<2            # Clipboard support for secret mode
 qrcode>=8.2,<9               # Generate QR codes for TOTP setup
 fastapi>=0.110,<1            # API server
 uvicorn>=0.29,<1             # API server
-starlette>=0.49.1,<1         # API server
+starlette>=0.40,<0.48        # API server (must remain compatible with FastAPI)
 httpx>=0.28.1,<1             # API server
 requests>=2.32,<3            # API server
 python-multipart>=0.0.22,<0.1  # API server file uploads

src/runtime_requirements.txt

@@ -22,7 +22,7 @@ qrcode>=8.2,<9
 typer>=0.12.3,<1
 fastapi>=0.110,<1
 uvicorn>=0.29,<1
-starlette>=0.47.2,<1
+starlette>=0.40,<0.48
 httpx>=0.28.1,<1
 requests>=2.32,<3
 python-multipart>=0.0.20,<0.1