fixed-requirements.txt

# Package versions fixed (pinned) for the whole st2 project.
# Important: Keep version constraints synchronised with the below repositories:
# - https://github.com/StackStorm/st2docs
# - https://github.com/StackStorm/orquesta
# - https://github.com/StackStorm/st2-auth-ldap
# - https://github.com/StackStorm/st2-rbac-backend
# ----------------------------------------------------------------------
# Note: amqp is used by kombu
amqp==5.3.1
apscheduler==3.11.0
chardet==5.2.0
cffi==1.17.1
cryptography==43.0.3
eventlet==0.39.1
flex==6.14.1
# Note: installs gitpython==3.1.37 (security fixed) under py3.8 and gitpython==3.1.18 (latest available, vulnerable) under py3.6
# TODO: Pin to 3.1.37 or higher after dropping python3.6 support
gitpython==3.1.45
# Needed by gitpython, old versions used to bundle it
gitdb==4.0.12
# Note: greenlet is used by eventlet
greenlet==3.1.1
gunicorn==23.0.0
jsonpath-rw==1.4.0
jsonschema==3.2.0
kombu==5.5.4
lockfile==0.12.2
mongoengine==0.29.1
networkx==3.1
# jsonpath-rw is the only thing that depends on decorator (a transitive dep)
decorator==5.2.1
# 202403: Bump oslo.config for py3.10 support.
oslo.config==9.6.0
oslo.utils==7.3.0
paramiko==3.5.1
# 202403: bump to 3.0.43 for py3.10 support
prompt-toolkit==3.0.52
pyinotify==0.9.6 ; platform_system=="Linux"
pymongo==4.6.3
pyparsing==3.1.4
zstandard==0.23.0
# pyOpenSSL 23.1.0 supports cryptography up to 40.0.x
#pyOpenSSL==23.1.0
# 202403: switch from python-editor to editor for py3.10 support
editor==1.6.6
# editor dependency, required here for inclusion in st2client setup.py
pygments==2.19.2
python-keyczar==0.716
pytz==2025.2
pywinrm==0.5.0
pyyaml==6.0.2
redis==6.1.1
requests==2.32.4
# urllib3 is a transitive dep
urllib3==2.2.3
retrying==1.4.2
routes==2.5.1
semver==3.0.4
six==1.17.0
argparse==1.4.0
argcomplete==3.6.2
prettytable==3.10.2
importlib-metadata==7.1.0
# 20250909 virtualenv 20.34.0 requires typing-extension>=4.13.2
typing-extensions>=4.13.2; python_version < "3.11"
# NOTE: sseclient has various issues which sometimes hang the connection for a long time, etc.
sseclient-py==1.8.0
stevedore==5.3.0
tenacity==9.0.0
tooz==6.3.0
# Note: virtualenv embeds wheels for pip, wheel, and setuptools. So pinning virtualenv pins those as well.
# virtualenv==20.30.0 (<21) has pip==25.0.1 wheel==0.45.1 setuptools==75.3.2
# lockfiles/st2.lock has pip==25.0.1 wheel==0.45.1 setuptools==75.3.2
virtualenv==20.34.0
# This setuptools version number is in the Makefile, but CircleCI builds are pulling a version
# that is incompatible with our logshipper fork.
setuptools<78
webob==1.8.9
webtest==3.0.1
zake==0.2.2
# test requirements below
bcrypt==4.3.0
jinja2==3.1.6
mock==5.2.0
pytest==7.0.1
psutil==7.0.0
python-dateutil==2.9.0.post0
python-statsd==2.1.0
orjson==3.10.15
zipp==3.20.2