a352a21a10
shopdb/plugins/loader.py imports packaging.specifiers and packaging.version at module scope, but packaging was never listed in requirements.in. It was present in every development and CI environment as a transitive dependency of pytest, so the full suite passed while a venv built from requirements.txt alone could not import shopdb at all. The Windows installer builds exactly such a venv, so stage 3 failed on a customer server with ModuleNotFoundError: No module named 'packaging', after the runtime and all wheels had installed successfully. Add packaging to requirements.in, recompile the hashed lockfile, and add the wheel to the offline wheelhouse with the matching bundle-lock entry. The recompile also picked up newer uv formatting: inline environment markers on cffi and greenlet and shorter "via" comments. The pinned distribution set and every existing hash are unchanged. tests/test_runtime_dependencies.py guards the general case by scanning shopdb/, plugins/ and scripts/ for unconditional third-party imports and asserting each maps to a distribution pinned in requirements.txt. Test dependencies are the blind spot for this class of failure, since they are present wherever the suite runs and absent wherever it does not.
44 lines
1.1 KiB
Plaintext
44 lines
1.1 KiB
Plaintext
# Flask and extensions
|
|
flask>=3.0
|
|
flask-sqlalchemy>=3.1
|
|
flask-migrate>=4.0
|
|
flask-jwt-extended>=4.6
|
|
flask-cors>=4.0
|
|
flask-caching>=2.0
|
|
flask-marshmallow>=1.2
|
|
marshmallow-sqlalchemy>=0.29
|
|
|
|
# Database
|
|
mysql-connector-python>=8.0
|
|
pymysql>=1.1
|
|
cryptography>=42.0 # pymysql needs it for MySQL 8 caching_sha2_password auth
|
|
|
|
# CLI and utilities
|
|
click>=8.1
|
|
python-dotenv>=1.0
|
|
tabulate>=0.9
|
|
|
|
# Plugin contract version checking (shopdb/plugins/loader.py).
|
|
# Declared explicitly because it reaches dev and CI only as a pytest
|
|
# dependency: every test passes while a production venv, which has no pytest,
|
|
# cannot import shopdb at all.
|
|
packaging>=23.0
|
|
|
|
# HTTP/API clients
|
|
requests>=2.31
|
|
|
|
# Security
|
|
werkzeug>=3.0
|
|
|
|
# Windows/IIS runtime
|
|
# waitress is the WSGI server IIS launches via HttpPlatformHandler.
|
|
# tzdata ships the IANA timezone database, which Windows does not provide;
|
|
# without it the notifications plugin fails on zoneinfo lookups.
|
|
# Both were previously hand-added to requirements.txt only, so a recompile
|
|
# would have silently dropped them from every Windows install.
|
|
waitress>=3.0
|
|
tzdata
|
|
|
|
# Validation
|
|
email-validator>=2.0
|