# Odoo 19 Requirements for Native macOS/Linux Development
# Based on: prepare-19 Docker image (Python 3.13.12, Debian Trixie slim)
# Updated: 19.08.2026
#
# Key differences for macOS:
#   - psycopg2-binary instead of psycopg2 (no pg_config needed)
#   - python-ldap may require OpenLDAP: brew install openldap
#   - pypdf replaces PyPDF2 for Python 3.13+

# Core Odoo dependencies (Python >= 3.13)
asn1crypto==1.5.1
Babel==2.17.0
cbor2==5.9.0  # CVE-2026-26209 (DoS via recursion in loads)
chardet==5.2.0
# Floor 50.0.0 required by eq-chatbot-core >= 3.0.0 and clears CVE-2026-69247
# (Bleichenbacher oracle, PKCS#7), CVE-2026-69248, CVE-2026-69249 and the
# vulnerable OpenSSL bundled in wheels below 48.0.1.
cryptography==50.0.0
decorator==5.1.1
docutils==0.20.1
freezegun==1.5.1
geoip2==2.9.0
gevent==24.11.1
greenlet==3.1.1
idna==3.18  # floor required by httpx2 (eq-chatbot-core >= 3.0.0)
Jinja2==3.1.6
libsass==0.22.0
# 6.1.0+ fixes CVE-2026-41066 (XXE via the iterparse()/ETCompatXMLParser()
# defaults). Odoo pins 6.0.2 for Python 3.14, so the 6.x line is upstream-
# sanctioned; odoo/_monkeypatches/lxml.py only patches lxml < 5.2.0.
lxml==6.1.2
lxml-html-clean
MarkupSafe==2.1.5
num2words==0.5.13
ofxparse==0.21
# 3.1.5 is the floor pandas declares for its Excel extra, and markitdown reads
# .xlsx through pandas — with Odoo's 3.1.2 the converter aborts with "Pandas
# requires version '3.1.5' or newer of 'openpyxl'" and eq_knowledge_ai reports
# "no text could be extracted". Same minor as Odoo's pin, three patch releases
# on; 3.1.5 is also the newest release of the line.
openpyxl==3.1.5
passlib==1.7.4
# 12.3.0 clears 17 advisories affecting 11.1.0 (heap OOB writes in ImageCms /
# ImagingExpand / paste-crop, PSD OOB write, several decompression bombs).
# Odoo pins 12.1.1 for Python 3.14, so the 12.x line is upstream-sanctioned.
Pillow==12.3.0
polib==1.1.1
psutil==5.9.8

# PostgreSQL adapter - use binary for macOS (no pg_config needed)
psycopg2-binary==2.9.10

# 26.0.0 caps cryptography at <47 and would block the security bump above.
pyopenssl==26.4.0

# pypdf replaces PyPDF2 for Python 3.13+
# 6.x clears 70+ advisories against 5.4.0 (DoS / RAM exhaustion via malformed
# streams, xref tables and inline images). Odoo still pins 5.4.0 upstream, so
# odoo/tools/pdf/_pypdf.py and the eq_fr_* merge paths are verified locally.
pypdf==6.16.1

pyserial==3.5
python-dateutil==2.8.2

# LDAP - requires: brew install openldap
python-ldap==3.4.5  # CVE-2025-61911 / CVE-2025-61912 (filter escaping bypass)

python-magic>=0.4.27
python-stdnum==1.19
pytz  # intentionally unpinned - timezone data updates frequently
pyusb==1.2.1
qrcode==7.4.2
reportlab==4.1.0
requests==2.33.0  # CVE-2026-25645 (insecure temp file reuse)
rjsmin==1.2.0
urllib3==2.7.0  # CVE-2026-44431 / CVE-2026-44432 (cross-origin header leak, bomb)
vobject==0.9.6.1
Werkzeug==3.0.6  # CVE-2024-34069 (RCE via debugger); no <3.1 ceiling here, unlike
                 # v16 - v19's odoo/http.py never reads werkzeug.__version__
watchdog
xlrd==2.0.1
XlsxWriter==3.1.9
xlwt==1.3.0
zeep==4.3.3  # GHSA-4cc2-g9w2-fhf6 (SSRF)
rlPyCairo

# Custom libs (Equitania)
pycryptodome==3.23.0      # eq_pw_encryption
phonenumbers              # whatsapp (v19e), OCA
python-slugify            # odoo/tools
bleach==6.4.0             # v19-addons
markdown==3.10.2          # eq_website_markdown_import
PyYAML>=6.0.1,<7.0.0      # eq_fr_qweb2yaml, eq_website_markdown_import
paramiko>=3.5.0           # eq_releasemanager
python-barcode            # label printing
numpy>=1.26.3             # OCA server-tools/field_vector
unidecode                 # OCA
pdfminer.six==20260107    # odoo/tools/pdf
oauthlib==3.3.1           # OCA auth modules

# AI/Chatbot dependencies (eq-chatbot-core)
# Install eq-chatbot-core locally (run manually):
#   uv pip install -e ~/gitbase/PyPi-Projects/eq_chatbot_core[dev,rag,security,docs]
#
# The SDK stack (openai, anthropic, tiktoken, httpx/httpx2, pydantic, click) is
# resolved by eq-chatbot-core itself and is NOT repeated here: the previous
# duplicates pinned openai <3.0.0 and click <8.3.3, which contradict the floors
# v3.0.0 requires and would make this file unresolvable.
#
# Extras in use by the v19 addons:
#   rag      -> qdrant-client, imported directly by eq_chatbot_rag
#   security -> puremagic; without it FileValidator silently degrades to
#               extension-only checks on chatbot uploads (MIME spoofing)
#   docs     -> markitdown + pymupdf, used by eq_knowledge_ai via
#               eq_chatbot_core.services.document_extractor
# NOTE: the docs extra pulls in pymupdf (AGPL-3.0-or-later). Distributing an
# installation that includes it requires a commercial PyMuPDF license.
eq-chatbot-core[rag,security,docs]>=3.2.1

# Declared as an external_dependency by eq_chatbot_rag and imported directly,
# so it stays explicit even though [rag] already provides it.
qdrant-client>=1.12.0,<2.0.0

# Additional
# Required by odoo/_monkeypatches/bs4.py plus eq_lead_radar and eq_module_docs,
# which both declare it in external_dependencies.
beautifulsoup4
email_validator           # OCA
openupgradelib            # OCA migration scripts

# Declared in external_dependencies but never installed here, so Odoo refused to
# install the owning modules. Added 19.08.2026, all clean against OSV.
boto3>=1.40.0,<2.0.0      # v19-3rd-party website_scorm_elearning (S3 hosting);
                          # was already in the prepare-19 image but missing here
cachetools                # OCA component_event
dbfread                   # v19e account_winbooks_import
fsspec>=2024.5.0          # OCA fs_storage (floor taken from its manifest)
google-auth               # odoo cloud_storage_google, v19e social_push_notifications
jsonschema                # OCA endpoint
odoorpc                   # OCA upgrade_analysis
pyjwt                     # v19e pos_platform_order_grabfood
requests-oauthlib         # OCA webservice
responses                 # OCA webservice — a test double, but declared as a hard dependency
schwifty==2024.4.0        # OCA base_bank_from_iban pins this exact version; a newer
                          # one fails Odoo's external_dependencies check

# Removed on 19.08.2026 — no import in v19-server, v19-oca or any addons repo
# (checked across addons, chatbot, equitania, 3rd-party, fast-report, themes,
# website, mrp, biwe, enterprise, oca and the customer repos):
#   nextcloud-api-wrapper, parse-accept-language, holidays, python-gitlab,
#   pypandoc, python-docx, pyotp, pandas, deepl, dicttoxml, xmltodict,
#   xmlschema, msal (v19-microsoft365 is commented out in repos.yaml),
#   sphinx / sphinx_tabs / sphinxcontrib-httpdomain / sphinx_rtd_theme
#   (v19-server ships no doc build — doc/ only holds the CLA).
#
# Also dropped since the previous baseline, with no import anywhere in the v19
# tree (verified 28.08.2026): the "OCA REST-Framework Stack" - fastapi, a2wsgi,
# ujson, python-multipart, extendable, extendable-pydantic, typing-extensions -
# plus the Windows-only rl-renderPM ; sys_platform == 'win32' and
# tzdata ; sys_platform == 'win32'. pyjwt survives (see the "Additional"
# section above), just re-justified for pos_platform_order_grabfood instead.
