# Core dependencies
aiohttp>=3.14.5
uvloop>=0.21.0; sys_platform == "linux" and python_version >= "3.14"  # phase-68
urllib3>=2.8.0  # CVE-2025-50181/66418/66471/CVE-2026-21441 — fixed in 2.5/2.6/2.6.3; 2.7.2 never released
asyncio-throttle==1.0.2
aiodns==4.0.4
cryptography>=50.0.2  # phase-304: was >=45.0.0 — subgroup-attack CVE fixed in 46.0.5
prometheus-client==0.26.0
pyyaml==6.0.3
redis==8.1.0
fastapi>=0.162.0  # Management API + /health/deep endpoint tests
scapy>=2.8.0
sse-starlette>=3.6.0

# Security dependencies
pytricia==1.3.0
geoip2==5.3.0
hypothesis==6.170.14
pip-audit>=2.10.1       # replaces safety (safety 3.x requires auth)
bandit==1.9.4

# Testing dependencies
fakeredis==2.40.0          # in-process Redis fake for integration tests (P19-G6); upgraded in phase-860
croniter>=6.2.4,<7            # cron expression parser for BackupScheduler (P19-G1)
pytest>=9.2.0          # CVE-2025-71176 fix (fixed in 9.0.3; 9.0.4 never released)
pytest-asyncio>=1.4.1,<2     # 1.x is compatible with pytest 8/9
pytest-cov==7.1.0
pytest-mock==3.17.0
pytest-xdist==3.8.0
pytest-timeout==2.4.0

# Development dependencies
black>=26.10.1
flake8==7.5.0
mypy==2.4.1
isort==9.0.2
pylint==4.1.3

# Compliance and audit
jsonschema>=4.26.0
cerberus==1.3.8
# phase-56: Runtime seccomp profile transition (optional — fails open if absent)
# Requires libseccomp-dev on the host: apt-get install libseccomp-dev
# python3-seccomp>=2.5.0

boto3>=1.43.123              # phase-57b: S3 cloud backup adapter (>=1.35 for urllib3 2.x compat)
moto[s3]>=5.2.5            # phase-57b: S3 mock for tests
google-cloud-storage>=3.17.1  # phase-57c: GCS backup adapter (optional). phase-800: floor raised from 2.0 — old api-core pulled protobuf<5 and blew pip resolution depth

tomli>=2.0; python_version < "3.11"  # phase-92: TOML validation fallback for Python 3.10

jsonpath-ng==1.15.0  # phase-85: REST generic TI feed client (src/analytics/ti_feeds/rest_generic.py)

protobuf>=7.36.2  # PYSEC-2026-1805 / CVE-2026-0994 fix (clears protobuf 4.x vulnerability)

# NOTE (phase-800 / phase-833 / phase-847): click (PYSEC-2026-2132) and protobuf
# (PYSEC-2026-1805) were waived while semgrep pinned vulnerable versions; both
# waivers were removed on 2026-10-23 (phase-847 close-out) because resolution now
# yields click 8.4.2 / protobuf 6.33.6, which the advisory database reports clean.
# The urllib3 and pygments waivers were removed in the same sweep, for the same
# reason. Do not re-add an --ignore-vuln without a fresh `pip-audit -r requirements.txt`.