[buildout]
# This file is part of buildout.coredev repository: https://github.com/plone/buildout.coredev
# The Plone Release Team is responsible for it, with help from lots of core Plone developers.
# If you have suggestions, please open an issue at: https://github.com/plone/buildout.coredev/issues
# Note: version pins in this file should only be removed in a new minor version of Plone.

# Based on latest development Zope:
# extends = https://raw.githubusercontent.com/zopefoundation/Zope/master/versions.cfg
# Based on released Zope:
extends = https://zopefoundation.github.io/Zope/releases/5.13/versions.cfg


[versions]
# Basics
# !! keep in sync with requirements.txt !!
packaging = 25.0
pip = 26.3
setuptools = 80.10.2
wheel = 0.48.0
zc.buildout = 4.2.0

# windows specific
nt-svcutils = 2.13.0

# OVERRIDES
mr.developer = 2.1.0
# Overrides of Zope pins for security fixes.
# Also check for Python-version specific overrides later in this file.
AccessControl = 7.7
# cffi 2 is needed by cryptography 50 and PyNaCl 1.6.2.
cffi = 2.1.1
certifi = 2026.10.23
idna = 3.20
Jinja2 = 3.1.6
multipart = 1.3.1
Pygments = 2.21.0
requests = 2.34.2
# RestrictedPython 9.0 removes bytes, sorted, tuple and zip from safe_builtins:
# AccessControl 7.7 adds guarded versions.
RestrictedPython = 9.0
soupsieve = 2.10
urllib3 = 2.8.0
WebOb = 1.8.11
# Overrides of Zope pins for bugfix releases.
persistent = 6.1.1
ZODB = 6.0.1
zope.testbrowser = 7.0.1

# CORE PLONE.
# These packages are what you get when installing Plone plus test dependencies,
# and are managed by the Plone community, not by Zope or others.
borg.localrole = 4.0.2
diazo = 2.0.6
five.intid = 2.0.1
Plone = 6.0.16
plone.alterego = 2.0.2
plone.api = 2.5.3
plone.app.caching = 3.1.6
plone.app.content = 4.2.1
plone.app.contentlisting = 3.0.6
plone.app.contentmenu = 3.0.8
plone.app.contentrules = 5.0.8
plone.app.contenttypes = 3.0.12
plone.app.customerize = 2.0.3
plone.app.dexterity = 3.2.3
plone.app.discussion = 4.1.5
plone.app.event = 5.2.4
plone.app.i18n = 4.0.2
plone.app.intid = 2.0.1
plone.app.iterate = 5.0.5
plone.app.layout = 4.1.3
plone.app.linkintegrity = 4.0.6
plone.app.locales = 6.0.30
plone.app.lockingbehavior = 2.0.3
plone.app.multilingual = 7.0.6
plone.app.portlets = 5.0.8
plone.app.querystring = 2.1.7
plone.app.redirector = 3.0.5
plone.app.registry = 2.0.7
plone.app.relationfield = 3.0.6
plone.app.robotframework = 2.1.6
plone.app.testing = 7.1.2
plone.app.textfield = 2.0.2
plone.app.theming = 5.0.15
plone.app.upgrade = 3.3.3
plone.app.users = 3.1.4
plone.app.uuid = 2.2.4
plone.app.versioningbehavior = 2.0.5
plone.app.viewletmanager = 4.0.5
plone.app.vocabularies = 5.0.5
plone.app.widgets = 5.0.2
plone.app.workflow = 5.0.4
plone.app.z3cform = 4.3.2
plone.autoform = 2.0.5
plone.autoinclude = 2.0.5
plone.base = 1.4.1
plone.batching = 2.0.8
plone.behavior = 2.0.3
plone.browserlayer = 3.0.2
plone.cachepurging = 3.0.3
plone.caching = 2.0.2
plone.contentrules = 3.0.2
plone.dexterity = 3.0.8
plone.event = 2.0.3
plone.folder = 4.0.2
plone.formwidget.namedfile = 3.1.2
plone.formwidget.recurrence = 3.0.6
plone.i18n = 5.1.1
plone.indexer = 2.0.2
plone.intelligenttext = 4.0.2
plone.keyring = 4.0.3
plone.locking = 3.0.2
plone.memoize = 3.0.5
plone.namedfile = 7.4.0
plone.outputfilters = 5.0.5
plone.portlet.collection = 4.0.5
plone.portlet.static = 4.0.5
plone.portlets = 3.0.3
plone.protect = 5.0.5
plone.recipe.zope2instance = 8.0.1
plone.registry = 2.0.2
plone.resource = 3.0.3
plone.resourceeditor = 4.0.2
plone.rest = 5.1.0
plone.restapi = 9.15.8
plone.rfc822 = 3.0.2
plone.scale = 4.3.1
plone.schema = 2.0.3
plone.schemaeditor = 4.0.13
plone.session = 4.0.6
plone.staticresources = 2.1.19
plone.stringinterp = 2.0.3
plone.subrequest = 2.0.6
plone.supermodel = 2.0.5
plone.testing = 9.0.7
plone.theme = 4.0.4
plone.tiles = 3.0.3
plone.transformchain = 3.0.2
plone.uuid = 2.0.2
plone.volto = 4.4.6
plone.z3cform = 2.0.5
plonetheme.barceloneta = 3.1.13
Products.CMFDiffTool = 4.0.5
Products.CMFDynamicViewFTI = 7.0.3
Products.CMFEditions = 4.0.7
Products.CMFPlacefulWorkflow = 3.0.6
Products.CMFPlone = 6.0.16
Products.ExtendedPathIndex = 5.0.0
Products.isurlinportal = 2.1.0
Products.MimetypesRegistry = 3.0.2
Products.PlonePAS = 8.0.5
Products.PortalTransforms = 4.1.1
Products.statusmessages = 5.0.7
Products.validation = 3.0.1

# CORE DEPENDENCIES: COLLECTIVE.
# These packages are what you get when installing Plone plus test dependencies,
# and are managed by the Collective (https://github.com/collective).
collective.MockMailHost = 3.0.0
collective.monkeypatcher = 2.0.1
collective.recipe.omelette = 2.0.0
collective.recipe.vscode = 0.1.9
collective.xmltestreport = 2.0.2
icalendar = 5.0.14
Products.DateRecurringIndex = 3.0.1
robotsuite = 2.3.2

# CORE DEPENDENCIES: Zope and friends
# These packages are what you get when installing Plone,
# and are managed by the Zope/ZODB/z3c/repoze communities,
# which are close to Plone.
five.customerize = 3.0.0
Products.CMFCore = 3.7
Products.CMFUid = 4.2
Products.DCWorkflow = 3.0
Products.ExternalMethod = 6.0
Products.GenericSetup = 5.0.0
Products.MailHost = 6.0
Products.PluggableAuthService = 3.0
Products.PluginRegistry = 2.0
Products.PythonScripts = 5.1
Products.Sessions = 5.0
Products.SiteErrorLog = 6.0
Products.StandardCacheManagers = 5.0
Products.ZopeVersionControl = 4.1
repoze.xmliter = 1.0
z3c.caching = 3.0
z3c.form = 5.1
z3c.formwidget.query = 2.0.0
z3c.objpath = 2.0
z3c.relationfield = 2.0.0
z3c.zcmlhook = 2.0
zc.relation = 2.1
zdaemon = 5.1
ZEO = 6.0.0
ZODB3 = 3.11.0
zodbupdate = 2.0
zope.app.locales = 5.0
zope.componentvocabulary = 2.3.0
zope.copy = 5.0
zope.intid = 5.0
zope.keyreference = 6.0
zope.ramcache = 3.0
zope.sendmail = 6.2

# CORE DEPENDENCIES: other
# These packages are what you get when installing Plone and its tests,
# but are NOT managed by closely related communities.
async-generator = 1.10
attrs = 24.3.0
backports.cached-property = 1.0.2
cryptography = 50.0.2
click = 8.5.0
cssselect = 1.6.0
decorator = 5.3.1
exceptiongroup = 1.3.1
feedparser = 6.0.14
feedparser-sgmllib = 2.1.0
furl = 2.1.4
future = 1.0.0
gunicorn = 23.0.0
h11 = 0.16.0
importlib-resources = 6.5.2
jsonschema = 4.25.1
jsonschema-specifications = 2025.9.1
jeepney = 0.9.0
lxml = 5.4.0
lxml-html-clean = 0.4.4
manuel = 1.13.0
Markdown = 3.11.2
mock = 5.2.0
natsort = 8.4.0
orderedmultidict = 1.0.2
outcome = 1.3.0post0
overrides = 7.7.0
piexif = 1.1.3
Pillow = 13.0.0
prompt-toolkit = 3.0.53
py = 1.11.0
PyJWT = 2.15.1
pyOpenSSL = 26.4.0
pyrsistent = 0.20.0
PySocks = 1.7.1
python-dateutil = 2.9.0.post0
python-dotenv = 1.2.4
PyYAML = 6.0.3
referencing = 0.37.0
responses = 0.26.3

robotframework = 6.0.2
robotframework-assertion-engine = 3.0.3
robotframework-browser = 19.3.1
robotframework-debuglibrary = 2.5.0
# robotframework >= 6.1 is only supported with robotframwork-lsp >= 1.11.0,
# but https://github.com/robocorp/robotframework-lsp/issues/947
robotframework-lsp = 1.10.1
robotframework-pythonlibcore = 4.4.1
robotframework-selenium2library = 3.0.0
robotframework-selenium2screenshots = 0.8.1
robotframework-seleniumlibrary = 6.1.3
robotframework-seleniumtestability = 2.1.0

rpds-py = 0.22.3
SecretStorage = 3.5.0
seedir = 0.5.1
selenium = 4.9.1
sgmllib3k = 1.0.0
simplejson = 3.20.2
sniffio = 1.3.1
sortedcontainers = 2.4.0
toml = 0.10.2
trio = 0.27.0
trio-websocket = 0.11.1
types-PyYAML = 6.0.12.20261103
types-toml = 0.10.8.20260518
typing-extensions = 4.16.0
Unidecode = 1.4.0
urllib3-secure-extra = 0.1.0
watchdog = 6.0.0
wcwidth = 0.2.14
webresource = 1.2
wrapt = 1.17.3
wsproto = 1.2.0

[versions:python39]
# Newer versions of these packages need Python 3.10+.
AccessControl = 7.2
backports.tarfile = 1.2.0
cffi = 2.0.0
click = 8.1.8
cssselect = 1.3.0
docutils = 0.21.2
# feedparser 6.0.13+ uses feedparser-sgmllib instead of sgmllib3k.
feedparser = 6.0.12
Markdown = 3.9
pip = 26.0.1
Pillow = 11.3.0
prompt-toolkit = 3.0.52
python-dotenv = 1.0.1
referencing = 0.36.2
requests = 2.32.5
RestrictedPython = 8.0
SecretStorage = 3.3.3
soupsieve = 2.8.4
types-PyYAML = 6.0.12.20250915
types-toml = 0.10.8.20240310
urllib3 = 2.6.3

[versions:python310]
backports.tarfile = 1.2.0
# Newer versions of these packages need Python 3.11+.
AccessControl = 7.5
RestrictedPython = 8.5
cssselect = 1.5.0
Markdown = 3.10.3
Pillow = 12.3.0

[versions:python311]
backports.tarfile = 1.2.0

[versionannotations]
# keep this alphabetical please
cryptography =
    Since version 49 there are no wheels for x86_64 (Intel) macOS, only arm64.
    On Intel Macs pip builds it from source, which needs Rust and OpenSSL.
    In Plone core it is not installed, only via optional tooling.
grpcio =
   This has an exact version pin in the robotframework-browser package.
grpcio-tools =
   This has an exact version pin in the robotframework-browser package.
lxml =
    Keep lxml at 5.x for Plone 6.0.  Note that lxml 6.1.0 has a security fix
    (CVE-2026-41066): in lxml 5, iterparse() and ETCompatXMLParser() still
    resolve external entities by default, so untrusted XML can read local files.
    Plone core does not use those on untrusted XML, so it is not affected.
lxml-html-clean =
    Versions 0.4.5 and higher have a security fix, but need lxml 6.1.1 or higher.
    The fix (CVE-2026-49825) is about javascript: URLs in xlink:href when using
    Cleaner(safe_attrs_only=False).  The safe_html transform of
    Products.PortalTransforms is not affected: it uses safe_attrs_only=True and
    already removes attributes with script: or data: in their value.
protobuf =
   This has an exact version pin in the robotframework-browser package.
selenium =
    robotframework-seleniumlibrary 6.1.0 is incompatible with 4.10.0. See https://github.com/robotframework/SeleniumLibrary/issues/1835
docutils =
    On python39 Zope pins docutils to 0.20.1 because Sphinx <8 requires docutils <0.21 (and Spinx 8 requires Python 3.10+).
    But we pull in readme-renderer>=35.0 which depends on docutils>=0.21.2.