# The lint and type-check tools, pinned for CI and for local venvs alike:
#   pip install -c ci/constraints.txt -e ".[dev]"     (what `make install` runs)
#   uv pip install -c ci/constraints.txt -e ".[dev]"  (what ci.yml runs, with --system)
#
# `.[dev]` asks for ruff>=0.5 and mypy>=1.10, so every install resolved the newest
# release, and a new release could turn lint or the type check red on a tree nobody
# touched: between Sep 26 and Oct 5 CI moved from ruff 0.16.9 to 0.16.10 and from mypy
# 2.3.1 to 2.4.0 without a commit. These are the versions the last green run on
# rc/first-run resolved in all six jobs that install `.[dev]` (run 37575035874).
# Move them on purpose, in a commit of their own, with a green run.
ruff==0.17.3
mypy==2.4.0

# The TLS trust (#403): what uv.lock holds, so CI verifies HTTPS with the versions a uv
# sync gets. ci.yml installs with `uv pip install` and installers-check.yml with pip, and
# neither reads uv.lock: pip resolved truststore 0.10.5 against the lock's 0.10.4 (review
# of #403, n8). Both installs take this file. Move them with the lock.
truststore==0.10.5
certifi==2026.10.23
