# CI constraints: the CPU environment continuous integration resolves.
# Installable. Regenerate deliberately when upgrading a dependency:
#   pip install -e '.[dev]' && pip freeze --exclude-editable > constraints/ci.txt
# Not a lockfile: no hashes, and the torch index is passed on the command line
# rather than pinned here, because the CPU wheel lives outside PyPI.
#
# Generated 2026-07-29 on Python 3.14.4, linux-x86_64.
#   torch from https://download.pytorch.org/whl/cpu
#
# THREE PINS WERE RAISED BY HAND ON 2026-10-06, FOR ADVISORIES, NOT FOR FEATURES:
#   multidict  6.7.1  -> 6.9.1   CVE-2026-104874
#   setuptools 78.1.0 -> 83.0.0  CVE-2025-47273, CVE-2026-59890
#   urllib3    2.7.0  -> 2.8.0   CVE-2026-97687, CVE-2026-97688, CVE-2026-97689
#   fsspec     2026.4.0 -> 2026.6.0  CVE-2026-104851 (GHSA-27vj-qcqg-25rc), found by CI on the
#     first run after the gate was repaired, because the local venv that surfaced the other three
#     does not pin this one. The gate reporting something its author had not already found is the
#     whole point of having it.
# Six advisories against the pinned set, every one with a published fix, confirmed against OSV
# for these exact versions rather than inferred from a newer resolve.
#
# NOBODY HAD SEEN THEM, and that is the part worth keeping. Every dependency-advisory step had
# been failing since 2026-10-02 with DID NOT RUN, because pip-audit ran under `--strict` and
# could not look up the CPU torch build, so it exited printing no JSON at all. A gate that cannot
# report anything reports nothing about the other sixty packages either. The six were found the
# day that gate was repaired. All three fixes are well past the section 5 cooldown window (93, 20
# and 14 days at the time of the bump).

accelerate==1.14.0
aiohappyeyeballs==2.7.1
aiohttp==3.14.3
aiosignal==1.4.0
alembic==1.18.5
annotated-doc==0.0.5
anyio==4.14.2
attrs==26.1.0
build==1.5.0
certifi==2026.7.22
charset-normalizer==3.4.9
click==8.4.2
colorlog==6.12.0
coverage==7.15.2
datasets==5.0.1
dill==0.4.1
execnet==2.1.2
filelock==3.29.0
frozenlist==1.8.0
fsspec==2026.6.0
greenlet==3.5.4
h11==0.16.0
hf-xet==1.5.2
httpcore==1.0.9
httpx==0.28.1
huggingface_hub==1.25.1
idna==3.18
iniconfig==2.3.0
Jinja2==3.1.6
Mako==1.3.12
markdown-it-py==4.2.0
MarkupSafe==3.0.3
mdurl==0.1.2
mpmath==1.3.0
multidict==6.9.1
multiprocess==0.70.19
networkx==3.6.1
numpy==2.5.1
optuna==4.9.0
packaging==26.2
pandas==3.0.5
pluggy==1.6.0
propcache==0.5.2
psutil==7.2.2
pyarrow==25.0.0
Pygments==2.20.0
pyproject_hooks==1.2.0
pytest==9.1.1
pytest-cov==7.1.0
pytest-xdist==3.8.0
python-dateutil==2.9.0.post0
PyYAML==6.0.3
regex==2026.7.19
requests==2.34.2
rich==15.0.0
ruff==0.16.0
safetensors==0.8.0
setuptools==83.0.0
setuptools-rust==1.13.0
shellingham==1.5.4
shtab==1.8.1
six==1.17.0
SQLAlchemy==2.0.51
sympy==1.14.0
tokenizers==0.22.2
torch==2.13.0+cpu
tqdm==4.70.0
transformers==5.14.1
typer==0.27.0
typing_extensions==4.15.0
urllib3==2.8.0
xxhash==3.8.1
yarl==1.24.5
