# Dependencies are listed alphabetically by package name.
# Multiple entries for the same package (with different version constraints) are grouped together.

aiohttp>=3.13.5,<3.14.0; python_version < '3.10'
aiohttp>=3.14.1; python_version >= '3.10'
certifi>=2026.5.20
cffi>=2.0.0
# cheroot 8.5.2 fails to build with modern setuptools due to setuptools_scm_git_archive dependency
cheroot>=11.1.2
cherrypy>=18.10.0
# We need contextvars for salt-ssh
contextvars
croniter!=0.3.22,>=6.2.2; sys_platform != 'win32'
# cryptography 48.0.0 drops support for Python 3.9.0 and 3.9.1
# (only >3.9.1 is accepted), but the py3.9 lock files are compiled
# with --python-version=3.9 which includes those releases. Cap at the
# last 46.x release for Python 3.9 so uv pip compile can still resolve.
# Furthermore, pyOpenSSL 26.2 dropped X509Extension and add_extensions()
# which breaks salt/modules/tls.py. pyOpenSSL < 26.2 requires cryptography < 48.0.0.
cryptography>=46.0.7,<48.0.0
distro>=1.9.0
frozenlist>=1.8.0; python_version < '3.11'
frozenlist>=1.5.0; python_version >= '3.11'
gitpython>=3.1.50
immutables>=0.21
importlib-metadata>=8.7.0
jaraco.functools>=4.4.0
jaraco.context>=6.1.1
jaraco.text>=4.2.0
Jinja2>=3.1.6
jmespath>=1.1.0
looseversion
lxml>=6.1.1; sys_platform == 'win32'
MarkupSafe<4.0.0
# multidict 6.0.4 fails to source-build under clang 17+ with strict int/pointer
# conversion checks (macOS 15 onedir builds compile from sdist via
# --no-binary=:all:). 6.6+ fixed the C source compatibility.
multidict>=6.6.0
msgpack>=1.1.2
# Packaging 24.1+ imports annotations from __future__ which breaks
# salt-ssh on target hosts with older Python versions (Amazon Linux 2
# still ships Python 3.7). 26.x additionally uses positional-only
# `/` parameter syntax which is a SyntaxError on Python <3.8. Keep at
# 24.0 to preserve salt-ssh compatibility against legacy target
# Pythons; salt 3006.x still promises this matrix.
packaging==24.0
psutil<6.0.0; python_version <= '3.9'
psutil>=5.0.0; python_version >= '3.10'
# pymssql 2.3.12+ dropped win32 (32-bit Windows) wheels; salt 3006.x
# still builds a Windows x86 onedir, so pin to the last release that
# ships cp3X-win32 wheels.
pymssql==2.3.11; sys_platform == 'win32'
pymysql>=1.2.0; sys_platform == 'win32'
pyopenssl>=26.0.0,<26.2.0
python-dateutil>=2.9.0.post0
python-gnupg>=0.5.6
pythonnet>=3.0.5; sys_platform == 'win32'
tzdata; sys_platform == 'win32'
pywin32>=312; sys_platform == 'win32'
pycryptodomex>=3.23.0
PyYAML>=6.0.3
requests>=2.32.5 ; python_version < '3.10'
requests>=2.33.1 ; python_version >= '3.10'
rpm-vercmp; sys_platform == 'linux'
setproctitle>=1.3.7
# pyzmq 27 dropped its tornado runtime dep; pyzmq.eventloop submodules
# (zmqstream, future) still import tornado.ioloop at module load. Pin
# tornado explicitly so onedir lockfiles keep shipping it.
tornado>=6.5.5
# Python 3.9 stays on urllib3 1.26.x because botocore on py3.9 hard
# requires urllib3 < 2 and Salt 3006.x still builds a py3.9 onedir.
# The Python 3.10+ floor carries the urllib3 2.6.3 CVE backports
# (CVE-2025-66418, CVE-2026-21441).
urllib3>=1.26.20,<2.0.0; python_version < '3.10'
urllib3>=2.7.0; python_version >= '3.10'
virtualenv>=21.4.2
# Transitive of virtualenv; some uv resolver caches pin a stale 3.25
# version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
filelock>=3.29.1; python_version >= '3.10'
filelock>=3.19.1,<3.29.0; python_version < '3.10'
wmi>=1.5.1; sys_platform == 'win32'
xmltodict>=1.0.4; sys_platform == 'win32'
zipp>=3.23.1
apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
apache-libcloud>=3.9.1; python_version >= '3.10'
idna>=3.18
more-itertools>=10.8.0
pyasn1>=0.6.3
pycparser>=2.23
vultr>=1.0.1
