bambuddy/requirements-dev.txt
maziggy a3c1878f11 chore(deps): floor-pin sqlalchemy >=2.0.38, pin ruff exactly, align CI lint
sqlalchemy 2.0.38 switched the aiosqlite file-db pool from NullPool to
AsyncAdaptedQueuePool; _create_engine() passes pool_size/max_overflow on the
SQLite branch, so anything older dies at import. Postgres installs are
unaffected -- the branch is dead there.

The CI lint job ran `pip install ruff` (newest) while requirements-dev.txt
said >=0.8.0, so CI and contributors enforced different rule sets: ruff 0.8.4
reports 32 errors on a tree current ruff calls clean, 30 of them the since-
removed UP038. Pin ruff exactly and have CI install that pin.
2026-07-09 16:29:39 +02:00

31 lines
1.2 KiB
Text

# Development and testing dependencies
pytest>=8.0.0
pytest-asyncio>=0.23.0
pytest-cov>=4.1.0
pytest-xdist>=3.5.0
pytest-timeout>=2.4.0
# Test-suite sharding for CI matrix. Splits the test set evenly across N
# shards via --splits/--group; falls back to test-name hashing on the first
# run, and uses recorded durations on subsequent runs (.test_durations).
pytest-split>=0.9.0
httpx>=0.27.0
# Exact pin, deliberately. A floor lets a contributor's older ruff enforce rules
# the current one has retired (UP038 was removed — PEP 604 in isinstance() is
# slower than the tuple form), and lets `format --check` disagree between
# machines. CI's lint job installs this exact line, so local == CI. Bump on
# purpose, not by resolution order.
ruff==0.15.20
pre-commit>=4.0
# Required by pyftpdlib TLS_FTPHandler for mock FTP server tests
pyOpenSSL>=26.0.0
# Security scanning
bandit[sarif]>=1.7.0
pip-audit>=2.7.0
# Transitive of pip-audit→CacheControl. 1.2.1 patches GHSA-6v7p-g79w-8964
# (Unpacker SEGV/DoS on reuse after caught error). Not a runtime dep of
# Bambuddy — pinned here so the audit stays clean.
msgpack>=1.2.1
# Secrets scan: gitleaks (Go binary, not a Python package).
# Install: go install github.com/zricethezav/gitleaks/v8@latest