# Odoo 20 Requirements for Native macOS/Linux Development
# Based on: the v19 baseline, moved to Python 3.14 and aligned with the
# Python 3.14 pins of v20-server/requirements.txt
# Updated: 25.09.2026
#
# Odoo 20 accepts Python 3.12 - 3.14 (odoo/release.py) and PostgreSQL >= 16.
#
# Key differences for macOS:
#   - psycopg2-binary instead of psycopg2 (no pg_config needed)
#   - python-ldap may require OpenLDAP: brew install openldap
#   - pypdf replaces PyPDF2 for Python 3.13+

# Python 3.14 bumps against the v19 baseline (older pins ship no cp314 wheels):
#   gevent 24.11.1 -> 25.9.1, greenlet 3.1.1 -> 3.3.2 (Odoo's 3.14 pin),
#   psycopg2-binary 2.9.10 -> 2.9.11, python-stdnum 1.19 -> 2.2 and
#   vobject 0.9.6.1 -> 0.9.9 (both Odoo's 3.14 pins).
# Built from sdist on 3.14 (no cp314 wheel): MarkupSafe, python-ldap, rjsmin,
# ofxparse. Verified: installs on CPython 3.14.7 / macOS arm64.

# Core Odoo dependencies (Python >= 3.14)
asn1crypto==1.5.1
Babel==2.17.0
cbor2==5.9.0  # CVE-2026-26209 (DoS via recursion in loads)
chardet==5.2.0
# Floor 50.0.0 required by eq-chatbot-core >= 3.0.0 and clears CVE-2026-69247
# (Bleichenbacher oracle, PKCS#7), CVE-2026-69248, CVE-2026-69249 and the
# vulnerable OpenSSL bundled in wheels below 48.0.1.
cryptography==50.0.0
decorator==5.1.1
docutils==0.20.1
freezegun==1.5.1
geoip2==2.9.0
gevent==25.9.1
greenlet==3.3.2
h11==0.16.0  # new in the v20 server pins (CVE patch over Debian's 0.14.0)
idna==3.18  # floor required by httpx2 (eq-chatbot-core >= 3.0.0)
Jinja2==3.1.6
libsass==0.22.0
# 6.1.0+ fixes CVE-2026-41066 (XXE via the iterparse()/ETCompatXMLParser()
# defaults). Odoo pins 6.0.2 for Python 3.14, so the 6.x line is upstream-
# sanctioned; odoo/_monkeypatches/lxml.py only patches lxml < 5.2.0.
lxml==6.1.2
lxml-html-clean
# New in Odoo 20: addons/mail/controllers/attachment.py renders Markdown
# attachments with it and only logs a warning when it is missing. Not listed
# in Odoo's own requirements.txt.
markdown2==2.5.5
MarkupSafe==2.1.5
num2words==0.5.13
ofxparse==0.21
# 3.1.5 is the floor pandas declares for its Excel extra, and markitdown reads
# .xlsx through pandas — with Odoo's 3.1.2 the converter aborts with "Pandas
# requires version '3.1.5' or newer of 'openpyxl'" and eq_knowledge_ai reports
# "no text could be extracted". Same minor as Odoo's pin, three patch releases
# on; 3.1.5 is also the newest release of the line.
openpyxl==3.1.5
passlib==1.7.4
# 12.3.0 clears 17 advisories affecting 11.1.0 (heap OOB writes in ImageCms /
# ImagingExpand / paste-crop, PSD OOB write, several decompression bombs).
# Odoo pins 12.1.1 for Python 3.14, so the 12.x line is upstream-sanctioned.
Pillow==12.3.0
polib==1.1.1
psutil==5.9.8

# PostgreSQL adapter - use binary for macOS (no pg_config needed)
psycopg2-binary==2.9.11

# 26.0.0 caps cryptography at <47 and would block the security bump above.
pyopenssl==26.4.0

# pypdf replaces PyPDF2 for Python 3.13+
# 6.x clears 70+ advisories against 5.4.0 (DoS / RAM exhaustion via malformed
# streams, xref tables and inline images). Odoo still pins 5.4.0 upstream, so
# odoo/tools/pdf/_pypdf.py and the eq_fr_* merge paths are verified locally.
pypdf==6.16.1

pyserial==3.5
python-dateutil==2.8.2

# LDAP - requires: brew install openldap
python-ldap==3.4.5  # CVE-2025-61911 / CVE-2025-61912 (filter escaping bypass)

python-magic>=0.4.27
python-stdnum==2.2
pytz  # intentionally unpinned; v20-server itself dropped pytz (zoneinfo), kept for
      # addons ported from v19 that still import it
pyusb==1.2.1
qrcode==7.4.2
reportlab==4.1.0
requests==2.33.0  # CVE-2026-25645 (insecure temp file reuse)
rjsmin==1.2.0
urllib3==2.7.0  # CVE-2026-44431 / CVE-2026-44432 (cross-origin header leak, bomb)
vobject==0.9.9
Werkzeug==3.0.6  # CVE-2024-34069 (RCE via debugger); no <3.1 ceiling here, unlike
                 # v16 - v20's odoo/http.py never reads werkzeug.__version__
watchdog
xlrd==2.0.1
XlsxWriter==3.1.9
xlwt==1.3.0  # dropped by v20-server, kept for addons ported from v19
zeep==4.3.3  # GHSA-4cc2-g9w2-fhf6 (SSRF)
rlPyCairo

# Custom libs (Equitania)
pycryptodome==3.23.0      # eq_pw_encryption
phonenumbers              # whatsapp (v20e), OCA
python-slugify            # odoo/tools
bleach==6.4.0             # v20-addons
markdown==3.10.2          # eq_website_markdown_import
PyYAML>=6.0.1,<7.0.0      # eq_fr_qweb2yaml, eq_website_markdown_import
paramiko>=3.5.0           # eq_releasemanager
python-barcode            # label printing
numpy>=1.26.3             # OCA server-tools/field_vector
unidecode                 # OCA
pdfminer.six==20260107    # odoo/tools/pdf
oauthlib==3.3.1           # OCA auth modules

# AI/Chatbot dependencies (eq-chatbot-core)
# Install eq-chatbot-core locally (run manually):
#   uv pip install -e ~/gitbase/PyPi-Projects/eq_chatbot_core[dev,rag,security,docs]
#
# The SDK stack (openai, anthropic, tiktoken, httpx/httpx2, pydantic, click) is
# resolved by eq-chatbot-core itself and is NOT repeated here: the previous
# duplicates pinned openai <3.0.0 and click <8.3.3, which contradict the floors
# v3.0.0 requires and would make this file unresolvable.
#
# Extras in use by the v19 addons (carried over to v20):
#   rag      -> qdrant-client, imported directly by eq_chatbot_rag
#   security -> puremagic; without it FileValidator silently degrades to
#               extension-only checks on chatbot uploads (MIME spoofing)
#   docs     -> markitdown + pymupdf, used by eq_knowledge_ai via
#               eq_chatbot_core.services.document_extractor
# NOTE: the docs extra pulls in pymupdf (AGPL-3.0-or-later). Distributing an
# installation that includes it requires a commercial PyMuPDF license.
#
# Floor 3.3.0: eq_chatbot_mcp passes allow_private_ranges= to get_mcp_client(),
# which older releases reject with a TypeError on connect.
eq-chatbot-core[rag,security,docs]>=3.3.0

# Declared as an external_dependency by eq_chatbot_rag and imported directly,
# so it stays explicit even though [rag] already provides it.
qdrant-client>=1.12.0,<2.0.0

# Additional
# Required by odoo/_monkeypatches/bs4.py plus eq_lead_radar and eq_module_docs,
# which both declare it in external_dependencies.
beautifulsoup4
email_validator           # OCA
openupgradelib            # OCA migration scripts

# Declared in external_dependencies by v19 modules (carried over for their v20
# ports; re-check against the v20 repos once they are populated).
boto3>=1.40.0,<2.0.0      # website_scorm_elearning (S3 hosting)
cachetools                # OCA component_event
dbfread                   # enterprise account_winbooks_import
fsspec>=2024.5.0          # OCA fs_storage (floor taken from its manifest)
google-auth               # odoo cloud_storage_google, enterprise social_push_notifications
jsonschema                # OCA endpoint
odoorpc                   # OCA upgrade_analysis
pyjwt                     # enterprise pos_platform_order_grabfood
requests-oauthlib         # OCA webservice
responses                 # OCA webservice — a test double, but declared as a hard dependency
schwifty==2024.4.0        # OCA base_bank_from_iban pins this exact version; a newer
                          # one fails Odoo's external_dependencies check
