# Odoo 18 Requirements for Native macOS Development
# Based on: prepare-18 Docker image (Python 3.13.12, Debian Trixie slim)
# Updated: 04.03.2026
#
# Key differences for macOS:
#   - psycopg2-binary instead of psycopg2 (no pg_config needed)
#   - python-ldap may require OpenLDAP: brew install openldap
#   - python-magic needs libmagic: brew install libmagic (without it Odoo falls
#     back to its own mimetype guessing, which works but is less precise)
#   - pypdf replaces PyPDF2 for Python 3.13+

# Core Odoo dependencies (Python >= 3.13)
asn1crypto==1.5.1
Babel==2.16.0
cbor2==5.9.0  # CVE-2026-26209 (DoS via recursion in loads)
chardet==5.2.0
cryptography==50.0.0  # floor required by eq-chatbot-core 3.x; CVE-2026-69247 (Bleichenbacher
                      # oracle, PKCS#7), CVE-2026-69248/69249, vulnerable OpenSSL in wheels < 48.0.1
decorator==5.1.1
docutils==0.20.1
freezegun==1.5.1
geoip2==2.9.0
gevent==24.11.1
greenlet==3.1.1
idna==3.18  # CVE-2026-45409 (IDNA encode bypass); also the httpx2 floor
Jinja2==3.1.6
libsass==0.22.0
lxml==6.1.2  # CVE-2026-41066 (XXE via iterparse()/ETCompatXMLParser() defaults)
lxml-html-clean
MarkupSafe==2.1.5
num2words==0.5.13
ofxparse==0.21
openpyxl==3.1.2
passlib==1.7.4
Pillow==12.3.0  # 17 advisories: heap OOB writes in ImageCms / ImagingExpand /
                # paste-crop, PSD OOB write, several decompression bombs
polib==1.1.1
psutil==5.9.8

# PostgreSQL adapter - use binary for macOS (no pg_config needed)
psycopg2-binary==2.9.10

pyopenssl==26.4.0  # <26 dies on Odoo startup with cryptography>=49 (GEN_EMAIL);
                   # 26.0.0 caps cryptography<47, 26.4.0 wants >=49,<51

# pypdf replaces PyPDF2 for Python 3.13+
pypdf==6.16.1  # 70+ advisories (DoS / RAM exhaustion via malformed streams, xref
               # tables, inline images)

pyserial==3.5
python-dateutil==2.8.2

# LDAP - requires: brew install openldap
python-ldap==3.4.5  # CVE-2025-61911 / CVE-2025-61912 (filter escaping bypass)

python-stdnum==1.19
pytz  # intentionally unpinned - timezone data updates frequently
pyusb==1.2.1
qrcode==7.4.2
reportlab==4.1.0
requests==2.33.0  # CVE-2026-25645 (insecure temp file reuse)
rjsmin==1.2.0
urllib3==2.7.0  # CVE-2026-44431 / CVE-2026-44432 (cross-origin header leak, bomb)
vobject==0.9.6.1
Werkzeug==3.0.6  # CVE-2024-34069 (RCE via debugger); no <3.1 ceiling here, unlike
                 # v16 - v18's odoo/http.py never reads werkzeug.__version__
watchdog
xlrd==2.0.1
XlsxWriter==3.1.9
xlwt==1.3.0
zeep==4.3.3  # GHSA-4cc2-g9w2-fhf6 (SSRF)
rlPyCairo

# PDF extraction - required by Odoo attachment_indexation module
pdfminer.six==20260107  # CVE-2025-70559 (pickle deserialization -> local privesc)

# Custom libs (Equitania)
pycryptodome==3.23.0
nextcloud-api-wrapper     # KEEP: the Equitania Nextcloud connector is still to be
                          # imported into v18. No import in the tree yet, so the usual
                          # unused-package sweep would drop it. Do not remove.
phonenumbers
python-slugify
bleach==6.4.0  # GHSA-8rfp-98v4-mmr6 / GHSA-gj48-438w-jh9v (URI sanitization bypass)
holidays==0.84
markdown==3.10.2
PyYAML>=6.0.1,<7.0.0
paramiko>=3.5.0
python-barcode
pandas>=2.1.0
numpy>=1.26.3
deepl
unidecode
oauthlib==3.3.1
xmltodict==0.13.0

# AI/Chatbot dependencies (eq-chatbot-core)
# Install eq-chatbot-core locally (run manually):
#   uv pip install -e ~/gitbase/PyPi-Projects/eq_chatbot_core[dev,rag,security,docs]
#
# The SDK stack (openai, anthropic, tiktoken, httpx/httpx2, pydantic, click) is
# resolved by eq-chatbot-core itself and is NOT repeated here: the previous
# duplicates pinned openai <3.0.0 and click <8.3.3, which contradict the floors
# v3.0.0 requires and would make this file unresolvable.
#
# Extras in use by the v18 addons:
#   rag      -> qdrant-client, imported directly by eq_chatbot_rag
#   security -> puremagic; without it FileValidator silently degrades to
#               extension-only checks on chatbot uploads (MIME spoofing)
#   docs     -> markitdown + pymupdf for services/document_extractor
eq-chatbot-core[rag,security,docs]>=3.0.0

# Declared as an external_dependency by eq_chatbot_rag and imported directly.
qdrant-client>=1.12.0,<2.0.0

# Imported by v18-oca and odoo core (attachment MIME detection).
python-magic>=0.4.27

# Additional
email_validator
openupgradelib

# Declared in external_dependencies but never installed, so Odoo refused to install
# the owning modules. Added 19.08.2026, all clean against OSV.
cachetools                # OCA component, component_event
dbfread                   # v18e account_winbooks_import
fsspec>=2024.5.0          # OCA fs_storage (floor taken from its manifest)
google-auth               # v18e social_push_notifications
odoorpc                   # OCA upgrade_analysis
pycountry                 # OCA base_iso3166, delivery_dhl_paket
pysftp                    # OCA auto_backup (see the paramiko note below)
requests-oauthlib         # OCA webservice
responses                 # OCA webservice - a test double, but declared as a hard dependency
schwifty==2024.4.0        # OCA base_bank_from_iban pins this exact version; a newer
                          # one fails Odoo's external_dependencies check

# Removed on 19.08.2026 - no import and no external_dependencies declaration
# anywhere in the v18 tree (23 repos incl. odoo core, enterprise, OCA, customers):
#   parse-accept-language, python-gitlab, pypandoc, python-docx, pyotp,
#   dicttoxml, xmlschema, msal (v18-m365 authenticates through plain requests,
#   it does not use msal) and the sphinx block. Plus a duplicate watchdog line.
# Deliberately NOT removed although v19 dropped them - these are in use here:
#   holidays (v18-solutions30), pandas (v18-sss, ks_dashboard_ninja),
#   deepl (v18-addons), xmltodict (v18-oca, edi_xml_oca).

# Declared by modules in the tree but deliberately NOT shipped:
#   PyPDF2 (syscoon_financeinterface_datev_xml) - unmaintained since 2023, its
#     successor pypdf is already here; shipping it would add an unpatched PDF parser
#   SQLAlchemy, gTTS (ks_dashboard_ninja), cairosvg, lottie, python-telegram-bot
#     (mail_gateway_telegram), plaid-python, py3o.template, py3o.formats, qifparse,
#     suds-community, factur-x, odoo_test_helper
#   These pull heavy or system-level dependencies for OCA modules we do not deploy.
#   Install them ad hoc if such a module is ever needed.
#
# paramiko: OCA auto_backup declares paramiko<4.0.0, we ship 5.x because
# eq_releasemanager uses it. auto_backup therefore stays uninstallable - deliberate,
# downgrading two major versions for one unused OCA module is the worse trade.
#
# Also dropped since the previous baseline, with no import anywhere in the v18
# tree (verified 28.08.2026): the "OCA REST-Framework Stack" - fastapi, a2wsgi,
# ujson, python-multipart, extendable, extendable-pydantic, pyjwt,
# typing-extensions - and rl-renderPM ; sys_platform == 'win32'. None are
# declared in any external_dependencies either; the real v18 environment no
# longer ships them.
