76d34a4b25
requirements.txt carried a hand-written header explaining why the lockfile is universal and hashed, what each flag buys, and a warning not to hand-edit it because waitress and tzdata were once added by hand and vanished on the next compile. Running `uv pip compile` to upgrade two packages wiped all of it, including the warning about hand-edits vanishing. The header had been documenting its own failure mode and still lost. The explanation now lives in requirements.in, which is the file people edit and which a compile never rewrites. The header is restored in requirements.txt for anyone reading that file directly, but it is no longer the only copy. Also records the --upgrade-package form for moving one package without moving everything else, and the scan_sbom.py check to run before a release.
69 lines
2.3 KiB
Plaintext
69 lines
2.3 KiB
Plaintext
# DIRECT requirements only. requirements.txt is COMPILED from this file:
|
|
#
|
|
# uv pip compile requirements.in --universal --generate-hashes -o requirements.txt
|
|
#
|
|
# Upgrade one package without moving everything else:
|
|
#
|
|
# uv pip compile requirements.in --universal --generate-hashes \
|
|
# --upgrade-package <name> -o requirements.txt
|
|
#
|
|
# This explanation lives HERE, not in requirements.txt, because a compile
|
|
# rewrites that file from scratch. The same guidance was written into its
|
|
# header once and was silently wiped by the next `uv pip compile` - including
|
|
# the line warning that hand-edits vanish. It is restored there for readers,
|
|
# but this copy is the one that survives.
|
|
#
|
|
# Only DIRECT requirements belong in this file. A runtime import satisfied in
|
|
# dev only because some test dependency happens to pull it in will pass every
|
|
# test and then fail on a production venv: `packaging` reached this project
|
|
# through pytest, and the Windows install could not import shopdb at all until
|
|
# it was declared. tests/test_runtime_dependencies.py guards that.
|
|
#
|
|
# Check dependencies against published advisories before a release:
|
|
#
|
|
# venv/bin/python scripts/scan_sbom.py --gate
|
|
|
|
# Flask and extensions
|
|
flask>=3.0
|
|
flask-sqlalchemy>=3.1
|
|
flask-migrate>=4.0
|
|
flask-jwt-extended>=4.6
|
|
flask-cors>=4.0
|
|
flask-caching>=2.0
|
|
flask-marshmallow>=1.2
|
|
marshmallow-sqlalchemy>=0.29
|
|
|
|
# Database
|
|
mysql-connector-python>=8.0
|
|
pymysql>=1.1
|
|
cryptography>=42.0 # pymysql needs it for MySQL 8 caching_sha2_password auth
|
|
|
|
# CLI and utilities
|
|
click>=8.1
|
|
python-dotenv>=1.0
|
|
tabulate>=0.9
|
|
|
|
# Plugin contract version checking (shopdb/plugins/loader.py).
|
|
# Declared explicitly because it reaches dev and CI only as a pytest
|
|
# dependency: every test passes while a production venv, which has no pytest,
|
|
# cannot import shopdb at all.
|
|
packaging>=23.0
|
|
|
|
# HTTP/API clients
|
|
requests>=2.31
|
|
|
|
# Security
|
|
werkzeug>=3.0
|
|
|
|
# Windows/IIS runtime
|
|
# waitress is the WSGI server IIS launches via HttpPlatformHandler.
|
|
# tzdata ships the IANA timezone database, which Windows does not provide;
|
|
# without it the notifications plugin fails on zoneinfo lookups.
|
|
# Both were previously hand-added to requirements.txt only, so a recompile
|
|
# would have silently dropped them from every Windows install.
|
|
waitress>=3.0
|
|
tzdata
|
|
|
|
# Validation
|
|
email-validator>=2.0
|