# IMPORTANT: The versions here must be compatible with the environment where
# uv-pre-commit hooks run. We do not pin setuptools in .pre-commit-config.yaml
# to allow uv to resolve a version that satisfies these constraints.
wheel >= 0.47.0
# Floor at the CVE fix: 78.1.1 patches GHSA-5rjg-fvgr-3xxf
# (PYSEC-2025-49) -- path traversal in setuptools.PackageIndex.download.
# Bumped to 82.0.1 to match the SRP baseline (PR #70130 on 3006.x); the
# earlier yarl / PEP 517 build-env conflict is no longer reproducible with
# our current pip and yarl versions -- 3007.x's lock resolves cleanly to
# setuptools 84.x with the same >=78.1.1 floor.
setuptools >= 82.0.1
# Cap setuptools-scm < 10 in PEP 517 build envs. 10.1.1 (2026-06-22) split
# version inference out into the ``vcs-versioning`` package; that path raises
# ``LookupError: setuptools-scm was unable to detect version`` for source
# tarballs that ship a ``PKG-INFO`` but no ``.git`` (e.g. cheroot 11.1.2 on
# PyPI), breaking ``--no-binary=:all:`` onedir builds. PIP_CONSTRAINT
# propagates to PEP 517 build envs since pip 22.1, so capping here keeps
# build envs on the pre-split 9.x series for every source build.
setuptools-scm < 10
# This pin is for the dev/lint tooling venvs only -- tools/pkg/build.py
# pins the packaged/shipped pip independently (currently 26.2) and is
# unaffected by this value. Bumping past 25.2 here causes the noxfile
# bootstrap pip install in the lint-pre-commit hook to upgrade the
# just-installed 25.2 inside the pre-commit hook venv on Python 3.14,
# which leaves the venv in a corrupted state because pip 26.0.1's
# vendored pygments wheel is missing the modeline submodule on cpython
# 3.14. Stay on 25.2.
pip == 25.2
markdown-it-py < 3.0.0; python_version == "3.9"
# myst-docutils 4.x (the latest supporting Python 3.10) requires
# markdown-it-py ~=3.0; the 5.x line that pairs with markdown-it-py 4.x
# only supports Python >=3.11.
markdown-it-py < 4.0.0; python_version == "3.10"
# Onedir shipped on 3006.x is Python 3.11; cap a few transitive deps that
# changed behaviour between the prior 3.10 lockfile and the latest 3.11
# resolution. Keeping these aligned with the prior 3.10 floors avoids
# test surface regressions from the python bump:
#   - jsonschema 4.x rewrote validator error messages that
#     tests/unit/utils/test_schema.py asserts on verbatim.
#   - bcrypt 5.x rejects secrets > 72 bytes that passlib's CryptContext
#     backend probe emits, breaking salt.utils.pycrypto tests.
#   - junos-eznc 2.7.x dropped its yamlordereddictloader dep, leaving
#     salt.modules.junos's optional import block setting HAS_JUNOS=False
#     and breaking ~30 patched-attribute test_junos.py cases.
jsonschema < 4; python_version == "3.11"
bcrypt < 5; python_version == "3.11"
junos-eznc < 2.7; python_version == "3.11"
# Cython 3.3.0 (2026-08-22) rejects the ``hint`` and ``c_addr`` redeclarations
# in pyzmq 27.1.0's ``zmq/backend/cython/_zmq.py`` and fails to emit ``_zmq.c``,
# breaking every source build of pyzmq (onedir Linux/macOS use
# ``--no-binary=:all:``). PIP_CONSTRAINT propagates into pyzmq's PEP 517 build
# env, so capping Cython here keeps the pyzmq wheel compiling until pyzmq
# ships a Cython 3.3-compatible release.
Cython < 3.3
