-r base.txt

psycopg2-binary==2.9.12  # https://github.com/psycopg/psycopg2
watchfiles==1.2.0  # https://github.com/samuelcolvin/watchfiles

# Testing
# ------------------------------------------------------------------------------

mypy==2.1.0  # https://github.com/python/mypy
django-stubs==6.0.6  # https://github.com/typeddjango/django-stubs
pytest==9.1.1  # https://github.com/pytest-dev/pytest
pytest-cov==7.1.0  # https://github.com/pytest-dev/pytest-cov
pytest-xdist==3.8.0  # https://github.com/pytest-dev/pytest-xdist (parallel test execution)
pytest-timeout==2.4.0  # https://github.com/pytest-dev/pytest-timeout (per-test hang guard in CI)
djangorestframework-stubs==3.17.0  # https://github.com/typeddjango/djangorestframework-stubs
responses==0.26.1  # https://github.com/getsentry/responses
# vcrpy 8.1.1 is the latest release and is NOT yet compatible with aiohttp
# >=3.14: its aiohttp stub subclasses aiohttp.streams.AsyncStreamReaderMixin at
# import time, a symbol aiohttp 3.14 removed (kevin1024/vcrpy#995; fix proposed
# in the unreleased PR #996). aiohttp is an unpinned transitive dep, so a fresh
# CI resolution picks up 3.14+. ensure_aiohttp_vcr_compat() in
# opencontractserver/utils/vcr_replay.py restores that symbol so vcrpy works
# under aiohttp >=3.14. Bump vcrpy here and delete the shim once a release ships
# the vcrpy#996 fix. See issue #1920.
vcrpy==8.2.1

# Profiling
# ------------------------------------------------------------------------------
django-cprofile-middleware
django-silk==5.5.0

# Code quality
# ------------------------------------------------------------------------------
flake8==7.3.0 # https://github.com/PyCQA/flake8
flake8-isort==7.0.0  # https://github.com/gforcada/flake8-isort
coverage==7.15.0  # https://github.com/nedbat/coveragepy
black==26.5.1  # https://github.com/psf/black
pre-commit==4.6.0  # https://github.com/pre-commit/pre-commit

# Django
# ------------------------------------------------------------------------------
factory-boy==3.3.3  # https://github.com/FactoryBoy/factory_boy
django-extensions==4.1  # https://github.com/django-extensions/django-extensions
django-coverage-plugin==3.2.2  # https://github.com/nedbat/django_coverage_plugin
pytest-django==4.12.0  # https://github.com/pytest-dev/pytest-django

# PDFs
# ------------------------------------------------------------------------------

# Office files
# ------------------------------------------------------------------------------
python-docx
openpyxl
python-pptx

# Test-only — OCR pipeline used by tests/test_pdf_redaction.py to verify the
# docling-parser microservice's OCR behavior. Production OCR runs in the
# docling-parser container, so this is not needed in base.txt.
# ------------------------------------------------------------------------------
pytesseract

# Not directly required, pinned by Snyk to avoid a vulnerability
# ------------------------------------------------------------------------------
django==5.2.15  # https://www.djangoproject.com/
twisted>=26.4.0 # not directly required, pinned by Snyk to avoid a vulnerability
ipython>=9.15.0 # not directly required, pinned by Snyk to avoid a vulnerability
requests>=2.34.2,<3 # not directly required, pinned by Snyk to avoid a vulnerability
setuptools>=82.0.1 # not directly required, pinned by Snyk to avoid a vulnerability
sqlparse>=0.5.5 # not directly required, pinned by Snyk to avoid a vulnerability
tornado>=6.5.7 # not directly required, pinned by Snyk to avoid a vulnerability
urllib3>=2.7.0 # not directly required, pinned by Snyk to avoid a vulnerability
zipp>=4.1.0 # not directly required, pinned by Snyk to avoid a vulnerability
pillow>=12.3.0 # not directly required, pinned by Snyk to avoid a vulnerability
