boto3>=1.19.4
click-config-file==0.6.0
click>=8.1.3
# cryptography is pinned for security: ensures the pip-level package is current.
# The `der` Rust crate vulnerability (AIKIDO-2026-296415 / YET-2668) comes from
# a Debian system package in the base image, not from cryptography itself
# (cryptography uses the `asn1` crate, not RustCrypto `der`). However this
# explicit pin guarantees we track the latest stable release.
cryptography>=44.0.0
dataclasses-json>=0.6.7
Jinja2>=3.1.6
pycarlo>=0.15.0,<1.0.0
python-box>=6.0.0
PyYAML>=5.4.1
questionary==2.0.1
requests>=2.0.0,<=3.0.0
retry==0.9.2
setuptools>=72.2.0 ; python_version >= "3.12"
tabulate>=0.8.7
