## ansible-core is pinned to an exact version on purpose. It is the release this
## collection is built, tested and security-scanned against, and Dependabot raises
## it whenever a newer patched release ships. Do not relax it to a range: a
## security bump is applied by rewriting ==X to ==Y here, so a range leaves
## Dependabot nothing to rewrite and the bump PRs stop arriving.
## Requires Python >= 3.12 -- install into a dedicated virtualenv. See README.md.
## NOTE: every comment here must start with ## -- sonarqube.yml runs
## sed 's/# \(.*\)/\1/' over this file, which would turn a single-# prose line
## into a bogus requirement and break pip install -r.
ansible-core==2.21.3
## Floor is 3.0.1, not 3.0.0. 3.0.0 declared its own dependencies with == pins,
## so installing it fixed requests/cryptography/Cerberus in the whole environment --
## either failing to resolve or silently changing them. 3.0.1 replaced those with
## ranges (BIPS-41882). The 3.x major also carries cryptography>=50.0.0, which clears
## XRAY-1003835 (vulnerable OpenSSL bundled in cryptography wheels <48.0.1).
beyondtrust-bips-library>=3.0.1,<4.0.0
## Dev dependencies, uncomment them to install in your local dev env:
# coverage==7.10.7
# pytest-ansible==25.1.0
# pre-commit==4.1.0
