# Resolved dependency tree for py-sdk, pinned so GitHub's dependency graph can see it.
#
# WHY THIS FILE EXISTS: pyproject.toml declares version *ranges*, and the graph records
# those as versionInfo: null -- Dependabot cannot match an advisory against "no version",
# so py-sdk had zero vulnerability detection. Every other ecosystem here has a lockfile;
# this is Python's.
#
# RESOLVED FOR PYTHON 3.9 -- the version CI runs and the floor pyproject declares.
# Do NOT regenerate on a newer interpreter: 3.10+ resolves a different tree (pytest 9.x,
# anyio 4.14) that cannot install on 3.9, which would make this file describe an
# environment we never actually build.
#
# NOT the install path. CI still runs `pip install -e ".[dev]"` against the declared
# ranges, so an upstream breaking change still surfaces. This file exists to be scanned.
#
# KNOWN, EXPECTED ALERT: pytest==8.4.2 carries GHSA-6w46-j5rx-g56g (tmpdir handling).
# It is unfixable while we support Python 3.9 -- the patched pytest 9.0.3 requires >=3.10.
# It is a dev/test dependency, never shipped to consumers. Closing it means dropping
# Python 3.9 (bump requires-python and the CI matrix); until that call is made, treat this
# alert as accepted rather than actionable.
#
# UNVERIFIED: whether Dependabot will also *update* this file is untested -- it maintains
# lockfiles it resolves from a manifest it installs with, and nothing installs from this
# one. If security-update PRs never appear, regenerate by hand:
#   pip install --dry-run --ignore-installed --python-version 3.9 --only-binary=:all: \
#       --report r.json "httpx>=0.28.1" "typing_extensions>=4.0.0" "pytest>=7.0.0" \
#       "pytest-asyncio>=0.21.0" "pytest-httpx>=0.21.0"
Pygments==2.20.0
anyio==4.12.1
backports.asyncio.runner==1.2.0
certifi==2026.7.22
exceptiongroup==1.3.1
h11==0.16.0
httpcore==1.0.9
httpx==0.28.1
idna==3.18
iniconfig==2.1.0
packaging==26.2
pluggy==1.6.0
pytest==8.4.2
pytest-asyncio==1.2.0
pytest-httpx==0.35.0
tomli==2.4.1
typing_extensions==4.16.0
