splunktaucclib>=6.5.0
# Pin packaging<24.1 for Python 3.7 compat (Splunk 9.2.x) — remove when Splunk 9.2.x support is dropped (2026-03)
packaging<24.1
licensing>=0.50
croniter>=5.0.1
# Pinned to MATCH the per-Python os-dependent cffi entries in globalConfig.json
# (2.0.0 for linux_with_deps_313/39 — set by the argon2-cffi-bindings 21.2.0
# manylinux2014 fix, commit b6a0f798). Without this pin the GENERIC lib/ copy
# floats independently: cffi 2.1.0 (first wheel hit CI 2026-07-06 21:32 UTC,
# 55 min after our last green build) ships a bin/cffi-gen-src RECORD entry that
# crashes ucc-gen's remove_packages (FileNotFoundError on
# lib/../../bin/cffi-gen-src) while REMOVING the generic copy of this
# os-dependent-delivered library — every branch's build died with zero change
# on our side. Same overnight-transitive class as the langsmith wave.open case,
# but at ucc-gen time where a build.py strip cannot help. Bump BOTH here and in
# globalConfig os-dependentLibraries together (verify a manylinux2014 wheel
# exists, per the argon2 lesson) once ucc-gen tolerates out-of-lib RECORD
# entries or cffi drops the script entry.
cffi==2.0.0
# Match both platform wheels; --no-deps on those entries prevents pip from
# adding a second cffi version over the separately pinned runtime backend.
cryptography==50.0.1
# The platform-specific argon2 backend must also reuse the pinned cffi.
argon2-cffi-bindings==21.2.0

# Optional backup S3 export (feature is opt-in; the minio SDK is imported lazily
# so deployments that do not configure an S3 target never load it or its
# compiled pycryptodome / argon2-cffi-bindings deps). Covers AWS S3 and
# S3-compatible stores (MinIO, etc.) via endpoint_url. Chosen over boto3 because
# botocore bundles a UDP Client-Side-Monitoring socket that trips Splunk Cloud
# AppInspect (check_for_python_udp_network_communications) plus ~28 MB of unused
# per-service models; minio is AppInspect-clean and does automatic multipart.
# pycryptodome / argon2-cffi-bindings are compiled — their per-Python wheels are
# declared in globalConfig.json os-dependentLibraries (mirroring cryptography).
minio>=7.2.0
# 3.0.0+ bundles the AI module (splunklib.ai.*) in the standard wheel.
# EXACT pin on purpose (reviewed 2026-09-09): every AI Advisor surface and all
# ~90 custom search commands / ~645 client.connect() sites sit on this SDK,
# and TrackMe reaches into private SDK structure (frozen ModelRequest
# mutation, req.state.messages, _supports_provider_strategy monkeypatch,
# the build-time set_groups FIPS guard). A floating spec let the next
# upstream release land in the .tgz on the next build with no diff on our
# side. Upstream 3.0.1 is behaviourally inert for us; the corrected release
# is now on PyPI. Keep the set_groups FIPS guard and mcp<2 cap: this release
# still needs both. Future SDK / mcp upgrades must move in lockstep.
# Bump deliberately, following
# ai-context/ai-advisors/splunk-sdk-version-policy.md; enforced by
# unit_tests/check_splunk_sdk_pin.py.
splunk-sdk==3.0.1
pygal>=3.0.5
svglib>=1.5.1
# Pin below 5.0.0: reportlab 5.x dropped the _renderPM C backend entirely and
# only supports the cairo backend (rlPyCairo + pycairo), which we do not bundle.
# The whole build/CI pipeline ships the rl-renderPM 4.0.3 C extension
# (cp313 pre-built by CI's prebuild-renderpm-313 manylinux job with an
# auditwheel-repair pass vendoring libfreetype into rl_renderPM.libs/,
# cp39 via globalConfig.json os-dependentLibraries); 5.x makes PNG chart
# conversion fail at runtime with "cannot import desired renderPM backend
# rlPyCairo", forcing every stateful-alert chart to fall back to SVG.
# Runtime consumers MUST pin reportlab onto the bundled backend BEFORE
# importing svglib/reportlab.graphics via trackme_libs_reportlab_backend
# (host-module collision otherwise breaks PNG on Splunk Cloud 10.x — see
# unit_tests/check_reportlab_backend_pin.py).
reportlab>=4.4.1,<5
pyyaml>=6.0.2
# Splunk Agent SDK AI dependencies (pure Python)
# mcp 2.0.0 (2026-07-28) removed the list_tools/call_tool decorators from
# mcp.server.lowlevel.Server (replaced by add_request_handler); splunklib.ai
# ToolRegistry (splunk-sdk 3.0.1) still registers via @server.list_tools(),
# so an unpinned build dies at import with AttributeError 'Server' object has
# no attribute 'list_tools' on every AI Advisor surface. Keep <2 until
# upstream splunk-sdk supports mcp 2.x.
mcp>=1.27.0,<2
pydantic>=2.13.2
langchain>=1.2.15
langchain-openai>=1.1.13
langchain-anthropic>=1.4.0
# Google Gemini / Vertex AI support — required by splunklib.ai.GoogleModel
# (splunk/splunk-sdk-python#727). Mirrors the optional `splunk-sdk[google]`
# extra in upstream pyproject.toml. Native langchain provider; coexists with
# our existing OAuth-via-SCS path for Google Vertex.
langchain-google-genai>=4.2.2
google-auth>=2.0.0
langgraph>=1.1.1
# Pinned to match the os-dependent entry in globalConfig.json (which uses
# dependencies=false to avoid the historic xxhash conflict — see commit
# 75b35462).  Without an explicit requirements.txt entry, ucc-gen 6.4.0
# fails the build when a newer transitive of langgraph / langchain pulls
# uuid-utils into the build host's environment (which happened after the
# SDK refresh in PR #1536).  The pin matches the os-dependent target.
uuid-utils==0.14.1
# Pinned to match the per-Python-3.9 os-dependent entry in globalConfig.json
# (which uses dependencies=false so the urllib3-v2 / requests-toolbelt
# transitive cascade doesn't re-land in linux_with_deps_39/).  ucc-gen
# refuses to build a dependencies=false entry without a matching pin
# here.  requests 2.33.0 dropped Python 3.9 (Requires-Python >=3.10) and
# introduced PEP 604 union syntax (``str | bytes``) in its own
# ``_internal_utils.to_native_string`` — capping cross-Python at 2.32.5
# (the last 3.9-compatible release) keeps Splunk 9.x working and is
# functionally a no-op on Python 3.13 / Splunk 10.x (2.32.5 still
# supports 3.13 and satisfies every AI dep in this file).  Remove the
# cap when Splunk 9.x support is dropped.
requests==2.32.5
