# Dependencies are listed alphabetically by package name.
# Multiple entries for the same package (with different version constraints) are grouped together.

aiohttp>=3.13.5,<3.14.0; python_version < '3.10'
aiohttp>=3.14.1; python_version >= '3.10'
apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
apache-libcloud>=3.9.1; python_version >= '3.10'
cffi>=2.0.0
# cheroot 8.5.2 fails to build with modern setuptools due to setuptools_scm_git_archive dependency
cheroot>=11.1.2
cherrypy>=18.10.0
# We need contextvars for salt-ssh
contextvars; python_version < '3.7'
croniter!=0.3.22,>=6.2.2; sys_platform != 'win32'
# cryptography 48.0.0 drops support for Python 3.9.0 and 3.9.1
# (only >3.9.1 is accepted), but the py3.9 lock files are compiled
# with --python-version=3.9 which includes those releases. Cap at the
# last 46.x release for Python 3.9 so uv pip compile can still resolve.
cryptography>=46.0.7,<48.0.0; python_version < '3.10'
cryptography>=48.0.0; python_version >= '3.10'
distro>=1.9.0
frozenlist>=1.8.0; python_version < '3.11'
frozenlist>=1.5.0; python_version >= '3.11'
gitpython>=3.1.50
idna>=3.18
immutables>=0.21; python_version < '3.7'
# importlib-metadata 9.x drops py3.9 support. Cap on py3.9, allow 8.7+ on
# py3.10, and let py>=3.11 use the existing 8.7+ floor.
importlib-metadata>=3.3.0,<9.0.0; python_version < '3.10'
importlib-metadata>=8.7.0; python_version >= '3.10'
jaraco.functools>=4.4.0
jaraco.context>=6.1.1
jaraco.text>=4.2.0
Jinja2>=3.1.6
jmespath>=1.1.0
looseversion
lxml>=6.1.1; sys_platform == 'win32'
MarkupSafe>=3.0.3
more-itertools>=10.8.0,<11.0.0; python_version < '3.10'
more-itertools>=11.1.0; python_version >= '3.10'
msgpack>=1.1.2 ; python_version < '3.13'
msgpack>=1.1.0 ; python_version >= '3.13'
opentelemetry-api>=1.41.1
opentelemetry-sdk>=1.41.1
opentelemetry-exporter-otlp-proto-http>=1.41.1
opentelemetry-exporter-prometheus>=0.62b1
xxhash>=3.7.0
# Packaging 24.1 imports annotations from __future__ which breaks salt ssh
# tests on target hosts with older python versions.
packaging>=26.2; python_version < '3.11'
packaging==24.0; python_version >= '3.11'
psutil<6.0.0; python_version <= '3.9'
psutil>=5.0.0; python_version >= '3.10'
pyasn1>=0.6.3
pycparser>=2.23,<3.0; python_version < '3.10'
pycparser>=3.0; python_version >= '3.10'
# pymssql 2.3.12+ dropped win32 (32-bit Windows) wheels; 3008.x still
# builds a Windows x86 onedir so keep the pin at the last release that
# ships cp3X-win32 wheels.
pymssql>=2.2.1,<=2.3.11; sys_platform == 'win32' and python_version < '3.11'
pymssql==2.3.11; sys_platform == 'win32' and python_version >= '3.11'
pyopenssl>=26.2.0
python-dateutil>=2.9.0.post0
python-gnupg>=0.5.6
pythonnet>=3.0.1; sys_platform == 'win32' and python_version < '3.11'
pythonnet>=3.0.4; sys_platform == 'win32' and python_version >= '3.11' and python_version < '3.13'
pythonnet>=3.1.0rc0; sys_platform == 'win32' and python_version >= '3.13'
pywin32>=312; sys_platform == 'win32'
pycryptodomex>=3.23.0
PyYAML>=6.0.3
requests>=2.32.5; python_version < '3.10'
requests<2.32.0 ; python_version >= '3.10' and python_version < '3.11'
requests>=2.32.5 ; python_version >= '3.11'
rpm-vercmp; sys_platform == 'linux'
setproctitle>=1.3.7
timelib>=0.3.0; python_version < '3.11'
timelib>=0.3.0; python_version >= '3.11'
tornado>=6.5.6
truststore>=0.10.0; python_version >= "3.10"
# Python 3.9 stays on urllib3 1.26.x because botocore on py3.9 hard
# requires urllib3 < 2 and Salt 3008.x still ships py3.9 lockfiles.
# The Python 3.10+ floor carries the urllib3 2.6.3 CVE backports
# (CVE-2025-66418, CVE-2026-21441).
urllib3>=1.26.20,<2.0.0; python_version < '3.10'
urllib3>=2.7.0; python_version >= '3.10'
virtualenv>=21.4.2
# Transitive of virtualenv; some uv resolver caches pin a stale 3.25
# version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
filelock>=3.29.1; python_version >= '3.10'
filelock>=3.19.1,<3.29.0; python_version < '3.10'
vultr>=1.0.1
wmi>=1.5.1; sys_platform == 'win32'
xmltodict>=1.0.4; sys_platform == 'win32'
zipp>=3.23.1
