pyproject.toml

[tool.poetry]
name = "robusta-api"
version = "0.0.0"
description = ""
authors = ["Arik Alon <arikalon1@users.noreply.github.com>"]
packages = [
    { include = "robusta", from = "src" },
]

[tool.black]
line-length = 120
target-version = ['py37']

[tool.isort]
line_length = 120
multi_line_output = 3
include_trailing_comma = true

[tool.poetry.dependencies]
python = ">=3.10, <3.12"
setuptools = "^80.9.0"
colorlog = "^5.0.1"
python-json-logger = "^3.0.0"
pydantic = "^2.11.7"
kubernetes = "^26.1.0"
pymsteams = "^0.1.16"
# Bump to fix CVE-2026-45409 / GHSA-65pc-fj4g-8rjx (Moderate, GHSA published
# 2026-05-19, older than 60 days): idna.encode() bypass of the CVE-2024-3651 fix
idna= { version = ">=3.15", optional = true }
supabase = "2.28.1"
tabulate = { version = "^0.8.10" }
slack-sdk = { version = "^3.23.0" }
Flask = { version = "^3.1.3", optional = true }
werkzeug = { version = ">=3.1.6", optional = true }
jinja2 = { version = ">=3.1.5", optional = true }
grafana-api = { version = "^1.0.3", optional = true }
watchdog =  { version = "^2.1.0", optional = true }
better-exceptions = { version =  "^0.3.3", optional = true }
# SVG -> PNG rasterizer for charts sent to chat sinks (resvg is Apache-2.0 OR MIT,
# bindings are MIT; replaced LGPL-licensed CairoSVG)
# Pinned to an exact version for supply-chain safety since the binding package
# has a small maintainer base (see PR #2136 review)
resvg-py = "0.3.4"
# Bump to fix CVE-2026-10142, CVE-2026-10143 (High): kafka-python protocol-parser DoS
kafka-python = { version = "^2.3.2", optional = true }
datadog-api-client = { version = "^1.2.0", optional = true }
dpath = "^2.0.5"
websocket-client = "1.3.3"
prometheus-client = "^0.12.0"
pyyaml = "^6.0"
pytz = "^2021.3"
poetry-core = "1.1.0a7"
docutils="0.19"
sentry-sdk = {extras = ["flask"], version = "^2.13.0"}
opsgenie-sdk = "^2.1.5"
markdown2 = "2.4.13"
toml = "^0.10.2"
watchgod = "^0.7"
webexteamssdk = "^1.6.1"
bitmath = "^1.3.3.1"
croniter = "^1.3.15"
humanize = "^3.13.1"
# we're freezing a specific version here because the latest version doesn't have prebuilt wheels on pypi
# and therefore requires gcc to install which we'd like to avoid
# this is similar to the issue at https://github.com/dulwich/dulwich/issues/839
# Pin to fix CVE-2026-69247 (High): cryptography Bleichenbacher oracle in PKCS#7 decryption
# Pin to fix CVE-2026-39892 (Critical): cryptography buffer overflow with non-contiguous buffers
# Pin to fix GHSA-537c-gmf6-5ccf (High): cryptography
cryptography = "^50.0.0"
# PDF renderer for KRR/Popeye scan reports (BSD-3-Clause; replaced LGPL-licensed fpdf2)
reportlab = "^5.0.0"
attrs = "^23.1.0"
prometrix = "0.2.11"
hikaru-model-26 = "^1.1.1"
apprise = "1.6.0"
rocketchat-api = "^1.30.0"
pydash = "8.0.0"
# The following are added to speed up poetry dependency resolution
botocore = "^1.42.19"
boto3 = "^1.42.19"
prometheus-api-client = "0.5.4"
requests = "^2.33.0"
# Bump to fix certifi CVE flagged by customer scan; date-versioned, so use >= rather than caret
certifi = ">=2026.4.22"
regex = "2024.5.15"
# Pin to fix CVE-2026-48526 (High) + CVE-2026-48522/48523/48525 (Medium): PyJWT
pyjwt = "^2.13.0"
urllib3 = "^2.7.0"
httpx = "0.27.2"
# realtime (supabase dependency) requires websockets.asyncio, added in websockets 13
websockets = ">=13"
# Pin to fix cve https://github.com/robusta-dev/robusta/security/dependabot/85
h2 = "^4.3.0"
# Pin to fix CVE-2026-30922 (transitive via google-auth)
# Bump to fix CVE-2026-59885, CVE-2026-59886 (High)
pyasn1 = ">=0.6.4"
# Pin to fix CVE-2026-63374 (Critical) + CVE-2026-64847 (Medium) (transitive via httpx)
anyio = "^4.14.2"
# Pin to fix CVE-2026-22701 (transitive via virtualenv/pre-commit)
filelock = ">=3.20.3"
# Pin to fix CVE-2026-22702 (transitive via pre-commit)
virtualenv = "^20.36.1"
# Pillow is used directly (MS Teams PNG->JPEG image conversion) and by reportlab.
# Pin to fix CVE-2026-54058,
# CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197,
# CVE-2026-59199, CVE-2026-59200, CVE-2026-59204, CVE-2026-59205 (High)
pillow = "^12.3.0"
# click is pulled in transitively (flask, typer). Pin to fix CVE-2026-7246 (High):
# command injection via unsanitized filename in click.edit()
click = ">=8.3.3"
# Used directly for the Supabase login retry (ROB-1228); was only transitive via opsgenie-sdk
tenacity = "^9.1.2"

[tool.poetry.dev-dependencies]
pre-commit = "^2.13.0"
# Pin to fix CVE-2025-71176 (pytest < 9.0.3)
pytest = "^9.0.3"
# Bump to fix CVE-2026-28684 (Medium, published 2026-04-20)
python-dotenv = "^1.2.2"
Sphinx = "6.2.1"
#furo = "^2021.11.12"
sphinx-autobuild = "^2021.3.14"
sphinx-copybutton = "^0.4.0"
sphinx-design = "0.5.0"
witchhazel = "^2018.8.23"
sphinx-autodoc-typehints = "^1.12.0"
sphinxcontrib-images = "^0.9.4"
jsonref = "^0.2"
sphinxcontrib-mermaid = "^0.7.1"
cssselect = "^1.1.0"
tinycss = "^0.4"
rsa = "^4.8"
sphinxcontrib-details-directive = "^0.1.0"
sphinx-immaterial = { git = "https://github.com/robusta-dev/robusta-immaterial.git" }
# TODO: Attempt to have different groups (docs, lint, etc) and install them separately
# Flake8 5.0.4 is the last version that supports Python 3.7
# As it does not work witn sphynx-immaterial, we need to exclude it from the dev dependencies
# Please, install it manually if you need to run flake8
# flake8 = "5.0.4"
black = "26.3.1"
mypy = "0.991"
isort = "5.10.1"
absolufy-imports = "^0.3.1"
types-pytz = "^2022.6.0.1"
types-requests = "^2.28.11.5"
types-cachetools = "^5.2.1"
types-PyYAML = "^6.0.0"
types-toml = "^0.10.2"
types-tabulate = "^0.8.10"

[tool.poetry.extras]
all = ["Flask", "grafana-api", "watchdog", "better-exceptions", "tabulate", "kafka-python", "prometheus-api-client", "supabase", "datadog-api-client", "sentry-sdk", "poetry-core"]

[tool.poetry.group.dev.dependencies]
sphinx-jinja = { git = "https://github.com/robusta-dev/sphinx-jinja.git" }
sphinx-reredirects = "^0.1.1"
freezegun = "^1.4.0"
# Bump to fix CVE-2026-82397 (High)
tornado = "^6.5.8"
responses = "^0.25.7"

[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"

# https://github.com/mtkennerly/poetry-dynamic-versioning
# we can use this in github actions by running `poetry run poetry-dynamic-versioning`
#[tool.poetry-dynamic-versioning]
#vcs = "git"
#pattern = "^(?P<base>\\d+\\.\\d+\\.\\d+)"

[tool.pytest.ini_options]
filterwarnings = [
    "ignore::DeprecationWarning",
    "ignore:::slack_sdk"
]