Cam Proudlock
a8f8580738
Clears every shipped finding the SBOM scan reported: pyjwt 2.13.0, idna 3.19, axios 1.20.0, postcss 8.5.26, dompurify 3.4.14, nanoid 3.3.18, follow-redirects 1.16.0, form-data 4.0.6. All in-major bumps inside ranges the manifests already allowed, so this is a lockfile refresh rather than a migration. The axios and dompurify floors were raised to match, since the old ones still nominally admitted the vulnerable range. The PyJWT allowlist entry was removed rather than kept - it stopped matching once the upgrade landed. Verified: full suite 2161 passed, frontend 273 passed, build clean, npm audit --omit=dev reports 0 vulnerabilities.
69 lines
2.3 KiB
Plaintext
69 lines
2.3 KiB
Plaintext
# DIRECT requirements only. requirements.txt is COMPILED from this file:
|
|
#
|
|
# uv pip compile requirements.in --universal --generate-hashes -o requirements.txt
|
|
#
|
|
# Upgrade one package without moving everything else:
|
|
#
|
|
# uv pip compile requirements.in --universal --generate-hashes \
|
|
# --upgrade-package <name> -o requirements.txt
|
|
#
|
|
# This explanation lives HERE, not in requirements.txt, because a compile
|
|
# rewrites that file from scratch. The same guidance was written into its
|
|
# header once and was silently wiped by the next `uv pip compile` - including
|
|
# the line warning that hand-edits vanish. It is restored there for readers,
|
|
# but this copy is the one that survives.
|
|
#
|
|
# Only DIRECT requirements belong in this file. A runtime import satisfied in
|
|
# dev only because some test dependency happens to pull it in will pass every
|
|
# test and then fail on a production venv: `packaging` reached this project
|
|
# through pytest, and the Windows install could not import shopdb at all until
|
|
# it was declared. tests/test_runtime_dependencies.py guards that.
|
|
#
|
|
# Check dependencies against published advisories before a release:
|
|
#
|
|
# venv/bin/python scripts/scan_sbom.py --gate
|
|
|
|
# Flask and extensions
|
|
flask>=3.0
|
|
flask-sqlalchemy>=3.1
|
|
flask-migrate>=4.0
|
|
flask-jwt-extended>=4.6
|
|
flask-cors>=4.0
|
|
flask-caching>=2.0
|
|
flask-marshmallow>=1.2
|
|
marshmallow-sqlalchemy>=0.29
|
|
|
|
# Database
|
|
mysql-connector-python>=8.0
|
|
pymysql>=1.1
|
|
cryptography>=42.0 # pymysql needs it for MySQL 8 caching_sha2_password auth
|
|
|
|
# CLI and utilities
|
|
click>=8.1
|
|
python-dotenv>=1.0
|
|
tabulate>=0.9
|
|
|
|
# Plugin contract version checking (shopdb/plugins/loader.py).
|
|
# Declared explicitly because it reaches dev and CI only as a pytest
|
|
# dependency: every test passes while a production venv, which has no pytest,
|
|
# cannot import shopdb at all.
|
|
packaging>=23.0
|
|
|
|
# HTTP/API clients
|
|
requests>=2.31
|
|
|
|
# Security
|
|
werkzeug>=3.0
|
|
|
|
# Windows/IIS runtime
|
|
# waitress is the WSGI server IIS launches via HttpPlatformHandler.
|
|
# tzdata ships the IANA timezone database, which Windows does not provide;
|
|
# without it the notifications plugin fails on zoneinfo lookups.
|
|
# Both were previously hand-added to requirements.txt only, so a recompile
|
|
# would have silently dropped them from every Windows install.
|
|
waitress>=3.0
|
|
tzdata
|
|
|
|
# Validation
|
|
email-validator>=2.0
|