# Fully-pinned CI environment for robustrep.
#
# Generated from a known-good local dev venv:
#     .venv/bin/pip freeze | grep -v '^-e ' > constraints.txt
# (the editable `-e ...robustrep` line is dropped; everything else is pinned `==`).
#
# Used ONLY as a pip constraints file in CI:
#     pip install -e ".[dev]" -c constraints.txt
# so every workflow run resolves the same dependency set and `pip-audit` sees
# exactly what the tests ran against. It is deliberately NOT the library's
# dependency metadata: `pyproject.toml` keeps open lower bounds so installing
# `robustrep` never forces these exact versions on a downstream user.
#
# Two things `pip freeze` does not emit are appended by hand:
#   * `pip` itself (freeze omits it), pinned so the runner image's own pip does
#     not drift -- CI installs it explicitly, a constraint alone won't upgrade pip;
#   * dependencies that only install on Linux (keyring's secret-storage backend
#     and its crypto chain), which a macOS freeze can never see. They are
#     marker-gated, so they stay uninstalled here and pinned in CI.
#
# Refresh by re-running the command above after upgrading the dev venv, keeping
# the hand-added block below.
annotated-doc==0.0.5
annotated-types==0.8.0
backports.tarfile==1.2.0
boolean.py==5.0
build==1.6.1
CacheControl==0.14.4
certifi==2026.7.22
charset-normalizer==3.5.1
contourpy==1.3.2
coverage==7.16.1
cycler==0.12.1
cyclonedx-python-lib==11.12.0
cytoolz==1.1.0
defusedxml==0.7.1
docutils==0.23
eth-hash==0.8.0
eth-typing==6.0.0
eth-utils==6.0.0
eth_abi==6.0.0
exceptiongroup==1.3.1
filelock==3.32.6
fonttools==4.65.0
id==1.6.1
idna==3.19
importlib_metadata==9.0.1
iniconfig==2.3.0
jaraco.classes==3.4.0
jaraco.context==6.1.2
jaraco.functools==4.6.0
keyring==25.7.0
kiwisolver==1.5.1
license-expression==30.4.4
markdown-it-py==4.2.0
matplotlib==3.10.9
mdurl==0.1.2
more-itertools==11.1.0
msgpack==1.2.2
nh3==0.3.7
numpy==2.2.6
packageurl-python==0.17.6
packaging==26.3
pandas==2.3.3
parsimonious==0.10.0
pillow==12.3.0
pip-requirements-parser==32.0.1
pip_api==0.0.35
pip_audit==2.10.1
platformdirs==4.11.8
pluggy==1.6.0
py-serializable==2.1.0
pycryptodome==3.23.0
pydantic==2.13.5
pydantic_core==2.46.5
Pygments==2.21.0
pyparsing==3.3.2
pyproject_hooks==1.2.0
pytest==9.1.1
pytest-cov==7.1.0
python-dateutil==2.9.0.post0
pytz==2026.3.post1
readme_renderer==46.0
regex==2026.9.10
requests==2.34.2
requests-toolbelt==1.0.0
rfc3986==2.0.0
rich==15.0.0
shellingham==1.5.4
six==1.17.0
sortedcontainers==2.4.0
tabulate==0.10.0
tomli==2.4.1
tomli_w==1.2.0
toolz==1.1.0
twine==7.0.0
typer==0.27.2
typing-inspection==0.4.4
typing_extensions==4.16.0
tzdata==2026.4
urllib3==2.7.0
zipp==4.1.0
# -- hand-added (not emitted by `pip freeze` on the dev box) -----------------
# pip itself: freeze omits it. CI installs this version explicitly before the
# project, since a constraint alone never upgrades the runner image's pip.
pip==26.2.1
# Linux-only: twine -> keyring pulls the secret-storage backend and its crypto
# chain under `sys_platform == "linux"`, so a macOS freeze can never see them
# while CI installs them on every job. Versions resolved with
#     pip install --dry-run --platform manylinux2014_x86_64 \
#         --only-binary=:all: SecretStorage jeepney
# (identical for 3.10 and 3.13). Marker-gated, so pinning them here is inert
# off Linux -- but it keeps them inside pip-audit's view.
SecretStorage==3.5.0
jeepney==0.9.0
cryptography==50.0.1
cffi==2.1.1
pycparser==3.0
