# OPTIONAL hardened-install constraints for muLLM.
#
# The core wheel is audited without this file in CI, matching pip install mullm.
# This file additionally constrains optional OpenTelemetry integrations.
# Last security refresh: 2026-11-04 (Pillow 13; OpenTelemetry 1.45.1).
#
# Use this file when you want extra determinism — air-gapped mirrors,
# older pip resolvers, or org policies that require an explicit pin set:
#   pip install -c constraints.txt mullm
#
# CVE floors (mirrored in pyproject.toml):
#   Pillow   >= 13.0.0   image decoder and PDF security fixes (2026)
#   requests >= 2.33.0   CVE-2024-35195 (proxy credential leak)
#   urllib3  >= 2.6.3    CVE-2024-37891 (proxy header injection)
#   numpy    >= 2.1.0    baseline for Py3.12+ wheels
#   keyring  >= 25.0.0   Secret Service hardening
#
# Compatibility: ChromaDB pulls OpenTelemetry exporters; all OTel
# packages must share a minor version or Chroma can fail at import time.
# A fresh resolve picks a coherent set automatically — these pins only
# protect partially-upgraded environments.

Pillow>=13.0.0
numpy>=2.1.0
requests>=2.33.0
urllib3>=2.6.3
keyring>=25.0.0

opentelemetry-api==1.45.1
opentelemetry-sdk==1.45.1
opentelemetry-proto==1.45.1
opentelemetry-exporter-otlp-proto-common==1.45.1
opentelemetry-exporter-otlp-proto-grpc==1.45.1
