# Flask and extensions
flask>=3.0
flask-sqlalchemy>=3.1
flask-migrate>=4.0
flask-jwt-extended>=4.6
flask-cors>=4.0
flask-caching>=2.0
flask-marshmallow>=1.2
marshmallow-sqlalchemy>=0.29

# Database
mysql-connector-python>=8.0
pymysql>=1.1
cryptography>=42.0   # pymysql needs it for MySQL 8 caching_sha2_password auth

# CLI and utilities
click>=8.1
python-dotenv>=1.0
tabulate>=0.9

# Plugin contract version checking (shopdb/plugins/loader.py).
# Declared explicitly because it reaches dev and CI only as a pytest
# dependency: every test passes while a production venv, which has no pytest,
# cannot import shopdb at all.
packaging>=23.0

# HTTP/API clients
requests>=2.31

# Security
werkzeug>=3.0

# Windows/IIS runtime
# waitress is the WSGI server IIS launches via HttpPlatformHandler.
# tzdata ships the IANA timezone database, which Windows does not provide;
# without it the notifications plugin fails on zoneinfo lookups.
# Both were previously hand-added to requirements.txt only, so a recompile
# would have silently dropped them from every Windows install.
waitress>=3.0
tzdata

# Validation
email-validator>=2.0