core/homeassistant/package_constraints.txt

aiodiscover==1.4.16
aiohttp-cors==0.7.0
aiohttp==3.8.5
astral==2.2
async-timeout==4.0.2
async-upnp-client==0.34.1
atomicwrites-homeassistant==1.4.1
attrs==22.2.0
awesomeversion==22.9.0
bcrypt==4.0.1
bleak-retry-connector==3.1.1
bleak==0.20.2
bluetooth-adapters==0.16.0
bluetooth-auto-recovery==1.2.1
bluetooth-data-tools==1.6.1
certifi>=2021.5.30
ciso8601==2.3.0
cryptography==41.0.2
dbus-fast==1.87.5
fnv-hash-fast==0.4.0
ha-av==10.1.0
hass-nabucasa==0.69.0
hassil==1.2.5
home-assistant-bluetooth==1.10.2
home-assistant-frontend==20230725.0
home-assistant-intents==2023.7.25
httpx==0.24.1
ifaddr==0.2.0
janus==1.0.0
Jinja2==3.1.2
lru-dict==1.2.0
mutagen==1.46.0
orjson==3.9.2
paho-mqtt==1.6.1
Pillow==10.0.0
pip>=21.3.1
psutil-home-assistant==0.0.1
PyJWT==2.8.0
PyNaCl==1.5.0
pyOpenSSL==23.2.0
pyserial==3.5
python-slugify==4.0.1
PyTurboJPEG==1.7.1
pyudev==0.23.2
PyYAML==6.0.1
requests==2.31.0
scapy==2.5.0
SQLAlchemy==2.0.15
typing-extensions>=4.7.0,<5.0
ulid-transform==0.8.0
voluptuous-serialize==2.6.0
voluptuous==0.13.1
webrtcvad==2.0.10
yarl==1.9.2
zeroconf==0.71.4

# Constrain pycryptodome to avoid vulnerability
# see https://github.com/home-assistant/core/pull/16238
pycryptodome>=3.6.6

# Constrain urllib3 to ensure we deal with CVE-2020-26137 and CVE-2021-33503
# Temporary setting an upper bound, to prevent compat issues with urllib3>=2
# https://github.com/home-assistant/core/issues/97248
urllib3>=1.26.5,<2

# Constrain httplib2 to protect against GHSA-93xj-8mrv-444m
# https://github.com/advisories/GHSA-93xj-8mrv-444m
httplib2>=0.19.0

# gRPC is an implicit dependency that we want to make explicit so we manage
# upgrades intentionally. It is a large package to build from source and we
# want to ensure we have wheels built.
grpcio==1.51.1
grpcio-status==1.51.1
grpcio-reflection==1.51.1

# libcst >=0.4.0 requires a newer Rust than we currently have available,
# thus our wheels builds fail. This pins it to the last working version,
# which at this point satisfies our needs.
libcst==0.3.23

# This is a old unmaintained library and is replaced with pycryptodome
pycrypto==1000000000.0.0

# This is a old unmaintained library and is replaced with faust-cchardet
cchardet==1000000000.0.0

# To remove reliance on typing
btlewrap>=0.0.10

# This overrides a built-in Python package
enum34==1000000000.0.0
typing==1000000000.0.0
uuid==1000000000.0.0

# regex causes segfault with version 2021.8.27
# https://bitbucket.org/mrabarnett/mrab-regex/issues/421/2021827-results-in-fatal-python-error
# This is fixed in 2021.8.28
regex==2021.8.28

# httpx requires httpcore, and httpcore requires anyio and h11, but the version constraints on
# these requirements are quite loose. As the entire stack has some outstanding issues, and
# even newer versions seem to introduce new issues, it's useful for us to pin all these
# requirements so we can directly link HA versions to these library versions.
anyio==3.7.1
h11==0.14.0
httpcore==0.17.3

# Ensure we have a hyperframe version that works in Python 3.10
# 5.2.0 fixed a collections abc deprecation
hyperframe>=5.2.0

# Ensure we run compatible with musllinux build env
numpy==1.23.2

# Prevent dependency conflicts between sisyphus-control and aioambient
# until upper bounds for sisyphus-control have been updated
# https://github.com/jkeljo/sisyphus-control/issues/6
python-engineio>=3.13.1,<4.0
python-socketio>=4.6.0,<5.0

# Constrain multidict to avoid typing issues
# https://github.com/home-assistant/core/pull/67046
multidict>=6.0.2

# Version 2.0 added typing, prevent accidental fallbacks
backoff>=2.0

# Require to avoid issues with decorators (#93904). v2 has breaking changes.
pydantic>=1.10.8,<2.0

# Breaks asyncio
# https://github.com/pubnub/python/issues/130
pubnub!=6.4.0

# Package's __init__.pyi stub has invalid syntax and breaks mypy
# https://github.com/dahlia/iso4217/issues/16
iso4217!=1.10.20220401

# Matplotlib 3.6.2 has issues building wheels on armhf/armv7
# We need at least >=2.1.0 (tensorflow integration -> pycocotools)
matplotlib==3.6.1

# pyOpenSSL 23.1.0 or later required to avoid import errors when
# cryptography 40.0.1 is installed with botocore
pyOpenSSL>=23.1.0

# protobuf must be in package constraints for the wheel
# builder to build binary wheels
protobuf==4.23.3

# faust-cchardet: Ensure we have a version we can build wheels
# 2.1.18 is the first version that works with our wheel builder
faust-cchardet>=2.1.18

# websockets 11.0 is missing files in the source distribution
# which break wheel builds so we need at least 11.0.1
# https://github.com/aaugustin/websockets/issues/1329
websockets>=11.0.1

# pyasn1 0.5.0 has breaking changes which cause pysnmplib to fail
# until they are resolved, we need to pin pyasn1 to 0.4.8 and
# pysnmplib to 5.0.21 to avoid the issue.
# https://github.com/pyasn1/pyasn1/pull/30#issuecomment-1517564335
# https://github.com/pysnmp/pysnmp/issues/51
pyasn1==0.4.8
pysnmplib==5.0.21
# pysnmp is no longer maintained and does not work with newer
# python
pysnmp==1000000000.0.0

# The get-mac package has been replaced with getmac. Installing get-mac alongside getmac
# breaks getmac due to them both sharing the same python package name inside 'getmac'.
get-mac==1000000000.0.0