requirements.in

# Linux source-install dependencies. Generates one
# `lockfiles/pyXX/requirements.txt` per supported Python LTS so each
# distro can pin against its native interpreter and pip can install
# with `--require-hashes` without any version markers in the lockfile.
# Each subdirectory under `lockfiles/` is a separate Dependabot
# watchpoint, except `lockfiles/py39/` and `lockfiles/py310/`.
# Upstream packages keep raising their minimum Python and Dependabot
# does not honour `requires_python`, so a version bump against those
# two would break RHEL 8 / Debian 11 (py39) and Ubuntu 22.04 (py310).
# Dropping the watchpoint stops version bumps only: Dependabot
# security updates scan every manifest in the repository regardless,
# so a security PR against a frozen lockfile still shows up.
# `.github/workflows/dependabot-auto-merge.yml` leaves it open for a
# human. Both frozen lockfiles are regenerated manually as needed.
#
# To regenerate all of them (run from a Linux host with all listed
# Python versions installed):
#
#   for v in 3.9 3.10 3.11 3.12 3.13 3.14; do
#     python${v} -m venv .venv-py${v//.}
#     ./.venv-py${v//.}/bin/python -m pip install 'pip<25.1' pip-tools \
#         typing_extensions
#     mkdir -p lockfiles/py${v//.}
#     ./.venv-py${v//.}/bin/python -m piptools compile --generate-hashes \
#         --strip-extras --allow-unsafe \
#         --output-file=lockfiles/py${v//.}/requirements.txt requirements.in
#   done
#
# All three names have to go into one `pip install`. Splitting the pip
# pin into its own call does not work: a fresh venv already ships a pip
# that satisfies `pip<25.1`, so that call is a no-op, and installing
# pip-tools afterwards pulls pip 26.x in as a dependency. `piptools`
# then dies with `ImportError: cannot import name 'stdlib_pkgs' from
# 'pip._internal.utils.compat'`, which pip 25.1 removed. One call lets
# the resolver honour both constraints and lands on pip 25.0.x.
# `typing_extensions` is listed because pip-tools imports it without
# declaring it as a dependency.
#
# That `piptools compile` run only adds and removes packages.
# pip-compile reads the existing lockfile as a constraint and never
# raises a pin on its own. Append `--upgrade-package NAME` to bump a
# single package, which is the usual case for a security fix on a
# frozen lockfile, or `--upgrade` to raise every pin.
#
# Build pipeline picks the lockfile that matches the target distro's
# Python (e.g. RHEL 8 / Debian 11 -> lockfiles/py39/requirements.txt;
# RHEL 9 default -> lockfiles/py39/requirements.txt; Debian 12 ->
# lockfiles/py311/requirements.txt; Debian 13 / RHEL 10 ->
# lockfiles/py312/requirements.txt).

beautifulsoup4
linuxfabrik-lib
lxml --only-binary=lxml
psutil
pyyaml
smbprotocol
vici
xmltodict