# Hash-pinned fuzz dependencies.
#
# Using a requirements.txt + --require-hashes is the pip idiom
# that (a) OpenSSF Scorecard recognizes for PinnedDependenciesID
# and (b) stays compatible across pip versions, unlike the bare
# `--hash` CLI flag which fails on the clusterfuzz container's
# pip with "no such option: --hash".

atheris==3.0.0 \
    --hash=sha256:8a5c8a781467c187da40fd29139784193e2647058831f837f675d0bb8cbd8746 \
    --hash=sha256:510e502c57b6dc615fb174066407af620d4c7f73cf08a782c86e7761bf12c4eb \
    --hash=sha256:a402cdca8a650d1371050b1f9552eb4cdc488d2db64950d603c4560318365eac

structlog==25.5.0 \
    --hash=sha256:a8453e9b9e636ec59bd9e79bbd4a72f025981b3ba0f5837aebf48f02f37a7f9f
