# Development and test tooling. Not installed into the runtime image.
#
# This is both the file humans edit and the file that gets installed. It lists
# DIRECT dependencies only; pip resolves the transitive tree at install time.
#
# The include is what makes `pip install -r requirements/dev.txt` a complete
# development environment rather than tooling with no application under it.
-r base.txt

# Lint and format (ruff's S rules cover the Bandit checks — SECURITY-BASELINE §10)
ruff==0.16.4

# Type checking
mypy==2.3.1                # django-stubs' compatible-mypy extra caps this at <2.4
django-stubs==6.1.0

# Tests
#
# pyyaml is a test-only dependency: tests/test_deploy_config.py parses
# docker-compose.prod.yml and deploy/docker-compose.external-tls.yml to assert
# the secure-by-default properties docs/self-hosting.md promises. Nothing at
# runtime reads YAML, so it stays out of base.txt and out of the image.
pyyaml==6.0.3
pytest==9.1.1
pytest-django==4.14.0
pytest-cov==7.1.0
pytest-xdist==3.8.0        # CI runs the suite across the runner's 4 cores

# Dependency audit (SECURITY-BASELINE §10)
pip-audit==2.10.1
