# Auction NLQ Engine — development / test dependencies
# Install: pip install -r requirements.txt -r requirements-dev.txt
#
# Split from requirements.txt because these are needed only to run the
# test suite and the eval/ harness's own tests, not to run the engine
# itself (e.g. in a production deployment).

pytest>=8.0.0
pytest-cov>=5.0.0

# Findings 5 + 9 (2026 audit): pinning (requirements.lock) stops a
# dependency changing without this repo's consent; pip-audit is the other
# half -- it tells you when something already pinned turns out to be
# vulnerable. Run with `pip-audit -r requirements.lock` (see
# .github/workflows/ci.yml, which runs this on every push, and
# docs/deployment-runbook.md).
pip-audit>=2.7.0

# Linter. Pinned to an exact version (unlike the tools above) because a
# ruff release can add or re-tune checks, and a lint gate whose verdict
# changes without a commit in this repo is not a gate. The `lint` job in
# .github/workflows/ci.yml installs exactly this line. Rules are pinned in
# pyproject.toml. Run locally with `ruff check .`; bump deliberately.
ruff==0.15.8