# Webapp Python dependencies, pinned with sha256 for the PXE server's
# Python 3.12 (Ubuntu 24.04, x86_64). scripts/download-packages.sh fetches
# exactly these into pip-wheels/; the playbook refuses any other wheel.
# To update: change a version here, regenerate the hashes
# (pip hash, or the PyPI JSON API), re-run download-packages.sh, and check
# for known vulnerabilities (osv.dev) before building a USB.

blinker==1.9.0 \
    --hash=sha256:ba0efaa9080b619ff2f3459d1d500c57bddea4a6b424b60a91141db6fd2f08bc
click==8.5.0 \
    --hash=sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360
flask==3.1.3 \
    --hash=sha256:f4bcbefc124291925f1a26446da31a5178f9483862233b23c0c96a20701f670c
itsdangerous==2.2.0 \
    --hash=sha256:c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef
jinja2==3.1.6 \
    --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
lxml==6.1.3 \
    --hash=sha256:379f8a75cf6eb7eef0af074b55f49ab73b868388a98de14646abcdfa4564bb11 \
    --hash=sha256:909f4e927bb051f7740d6367285fc60cdcfdaf0258c2dba4ff5ba7eadadc250c
markupsafe==3.0.4 \
    --hash=sha256:8e124f974786f831d6043728e38296969d3579db8896fe004682f5758e613581
werkzeug==3.1.9 \
    --hash=sha256:6392e50c78460ba618e5b21f08a71f59c99ce99cdc6cf6e3dd7e6ccca8754fab