requirements.in

# One hash-pinned lockfile per supported Python LTS lives under
# `lockfiles/pyXX/requirements.txt` (`py39` ... `py314`). Pick the
# one that matches the local Python version when reproducing a CI run
# or vendoring downstream. Each subdirectory under `lockfiles/` is a
# separate Dependabot watchpoint, except `lockfiles/py39/`. Most
# upstream packages dropped Python 3.9 over 2025/2026 and Dependabot
# does not honour `requires_python`, so a version bump against py39
# would break RHEL 8 / Debian 11. Dropping the watchpoint stops
# version bumps only: Dependabot security updates scan every manifest
# in the repository regardless, so a security PR against the frozen
# lockfile still shows up.
# `.github/workflows/dependabot-auto-merge.yml` leaves it open for a
# human. The py39 lockfile is regenerated manually as needed.
#
# To regenerate all of them:
#
#   for v in 3.9 3.10 3.11 3.12 3.13 3.14; do
#     python${v} -m venv .venv-py${v//.}
#     ./.venv-py${v//.}/bin/python -m pip install 'pip<25.1' pip-tools \
#         typing_extensions
#     mkdir -p lockfiles/py${v//.}
#     ./.venv-py${v//.}/bin/python -m piptools compile --generate-hashes \
#         --output-file=lockfiles/py${v//.}/requirements.txt requirements.in
#   done
#
# All three names have to go into one `pip install`. Splitting the pip
# pin into its own call does not work: a fresh venv already ships a pip
# that satisfies `pip<25.1`, so that call is a no-op, and installing
# pip-tools afterwards pulls pip 26.x in as a dependency. `piptools`
# then dies with `ImportError: cannot import name 'stdlib_pkgs' from
# 'pip._internal.utils.compat'`, which pip 25.1 removed. One call lets
# the resolver honour both constraints and lands on pip 25.0.x.
# `typing_extensions` is listed because pip-tools imports it without
# declaring it as a dependency.
#
# That `piptools compile` run only adds and removes packages.
# pip-compile reads the existing lockfile as a constraint and never
# raises a pin on its own. Append `--upgrade-package NAME` to bump a
# single package, which is the usual case for a security fix on a
# frozen lockfile, or `--upgrade` to raise every pin.

beautifulsoup4
httpx[http2]
lxml --only-binary=lxml
psutil
pymysql
pypsrp
PySmbClient
pywinrm
smbprotocol
xmltodict