[buildout]
# This file is part of buildout.coredev repository: https://github.com/plone/buildout.coredev
# The Plone Release Team is responsible for it, with help from lots of core Plone developers.
# If you have suggestions, please open an issue at: https://github.com/plone/buildout.coredev/issues
# Note: version pins in this file should only be removed in a new minor version of Plone.

# Based on latest development Zope:
# extends = https://raw.githubusercontent.com/zopefoundation/Zope/master/versions.cfg
# Based on released Zope:
extends = https://zopefoundation.github.io/Zope/releases/5.14.2/versions.cfg


[versions]
# Basics
# !! keep in sync with requirements.txt !!
packaging = 26.2
pip = 26.2.2
setuptools = 81.0.0
wheel = 0.47.0
zc.buildout = 4.2.0

# windows specific
nt-svcutils = 2.13.0

# OVERRIDES
# You MUST manually keep this in sync with the version-overrides in mx.ini.
# Also check for Python-version specific overrides later in this file.
# anyio 4.15+ needs typing-extensions 4.16+, but Zope pins 4.15.0.
anyio = 4.14.2
certifi = 2026.10.23
idna = 3.20
msgpack = 1.2.4
Pygments = 2.21.0
requests = 2.34.2
pytz = 2026.6
soupsieve = 2.10
urllib3 = 2.8.0
WebOb = 1.8.11

# CORE PLONE.
# These packages are what you get when installing Plone plus test dependencies,
# and are managed by the Plone community, not by Zope or others.
borg.localrole = 4.0.2
diazo = 2.0.6
five.intid = 3.1.0
Plone = 6.1.6
plone.alterego = 2.0.2
plone.api = 2.5.3
plone.app.caching = 4.1.1
plone.app.content = 4.2.1
plone.app.contentlisting = 3.0.6
plone.app.contentmenu = 3.0.8
plone.app.contentrules = 5.0.8
plone.app.contenttypes = 4.0.10
plone.app.customerize = 2.0.3
plone.app.dexterity = 4.1.3
plone.app.discussion = 5.2.3
plone.app.event = 5.2.4
plone.app.i18n = 4.0.2
plone.app.intid = 2.0.1
plone.app.iterate = 6.3.2
plone.app.layout = 5.0.3
plone.app.linkintegrity = 4.0.6
plone.app.locales = 6.1.2
plone.app.lockingbehavior = 2.0.3
plone.app.multilingual = 8.4.2
plone.app.portlets = 6.0.4
plone.app.querystring = 2.1.7
plone.app.redirector = 3.0.5
plone.app.registry = 2.0.7
plone.app.relationfield = 4.0.3
plone.app.robotframework = 2.1.6
plone.app.testing = 7.1.2
plone.app.textfield = 3.0.2
plone.app.theming = 6.0.0
plone.app.upgrade = 3.3.3
plone.app.users = 3.1.4
plone.app.uuid = 2.2.4
plone.app.versioningbehavior = 2.0.5
plone.app.viewletmanager = 4.0.5
plone.app.vocabularies = 6.0.4
plone.app.widgets = 5.0.2
plone.app.workflow = 5.0.4
plone.app.z3cform = 4.7.10
plone.autoform = 2.0.5
plone.autoinclude = 2.0.5
plone.base = 3.1.2
plone.batching = 2.0.8
plone.behavior = 2.0.3
plone.browserlayer = 3.0.2
plone.cachepurging = 3.0.3
plone.caching = 2.0.2
plone.classicui = 1.0.1
plone.contentrules = 3.0.2
plone.dexterity = 3.0.8
plone.distribution = 3.2.1
plone.event = 2.0.3
plone.exportimport = 1.3.1
plone.folder = 4.0.2
plone.formwidget.namedfile = 3.1.2
plone.formwidget.recurrence = 3.0.6
plone.i18n = 5.1.1
plone.indexer = 2.0.2
plone.intelligenttext = 4.0.2
plone.keyring = 4.0.3
plone.locking = 3.0.2
plone.memoize = 3.0.5
plone.namedfile = 7.4.0
plone.outputfilters = 5.0.5
plone.portlet.collection = 4.0.5
plone.portlet.static = 4.0.5
plone.portlets = 3.0.3
plone.protect = 5.0.5
plone.recipe.zope2instance = 8.0.1
plone.registry = 2.0.2
plone.resource = 3.0.3
plone.resourceeditor = 4.0.2
plone.rest = 5.1.0
plone.restapi = 9.15.8
plone.rfc822 = 3.0.2
plone.scale = 4.3.1
plone.schema = 2.0.3
plone.schemaeditor = 4.0.13
plone.session = 4.0.6
plone.staticresources = 2.3.9
plone.stringinterp = 2.0.3
plone.subrequest = 2.0.6
plone.supermodel = 2.0.5
plone.testing = 9.0.7
plone.theme = 4.0.4
plone.tiles = 3.0.3
plone.transformchain = 3.0.2
plone.uuid = 2.0.2
plone.volto = 5.2.4
plone.z3cform = 2.0.5
plonetheme.barceloneta = 3.3.4
Products.CMFDiffTool = 4.0.5
Products.CMFDynamicViewFTI = 7.0.3
Products.CMFEditions = 4.0.7
Products.CMFPlacefulWorkflow = 3.0.6
Products.CMFPlone = 6.1.6
Products.ExtendedPathIndex = 5.0.0
Products.isurlinportal = 3.1.0
Products.MimetypesRegistry = 3.0.2
Products.PlonePAS = 8.0.5
Products.PortalTransforms = 4.1.1
Products.statusmessages = 5.0.7
pytest-plone = 1.1.1

# CORE DEPENDENCIES: COLLECTIVE.
# These packages are what you get when installing Plone plus test dependencies,
# and are managed by the Collective (https://github.com/collective).
collective.MockMailHost = 3.0.0
collective.monkeypatcher = 2.0.1
collective.recipe.omelette = 2.0.0
collective.recipe.vscode = 0.1.9
collective.xmltestreport = 2.0.2
icalendar = 6.3.2
Products.DateRecurringIndex = 3.0.1

# CORE DEPENDENCIES: Zope and friends
# These packages are what you get when installing Plone,
# and are managed by the Zope/ZODB/z3c/repoze communities,
# which are close to Plone.
five.customerize = 4.1
Products.CMFCore = 3.7
Products.CMFUid = 4.2
Products.DCWorkflow = 3.0
Products.ExternalMethod = 6.0
Products.GenericSetup = 5.0.0
Products.MailHost = 6.0
Products.PluggableAuthService = 3.0
Products.PluginRegistry = 2.0
Products.PythonScripts = 5.1
Products.Sessions = 6.0
Products.SiteErrorLog = 6.0
Products.StandardCacheManagers = 5.0
Products.ZopeVersionControl = 4.1
repoze.xmliter = 1.0
z3c.caching = 4.0
z3c.form = 6.0.1
z3c.formwidget.query = 3.0
z3c.objpath = 3.0
z3c.relationfield = 3.1
z3c.unconfigure = 3.0
z3c.zcmlhook = 3.0
zc.relation = 2.1
zdaemon = 5.2.1
ZEO = 6.2
zest.releaser = 9.9.1
zestreleaser.towncrier = 2.0.1
ZODB3 = 3.11.0
zodbupdate = 3.0
zope.app.locales = 6.0
zope.componentvocabulary = 4.0
zope.copy = 6.0
zope.intid = 6.0
zope.keyreference = 7.0
zope.pytestlayer = 9.1
zope.ramcache = 4.0
zope.sendmail = 7.1.1

# CORE DEPENDENCIES: other
# These packages are what you get when installing Plone and its tests,
# but are NOT managed by closely related communities.
async-generator = 1.10
attrs = 26.1.0
backports.cached-property = 1.0.2
backports.tarfile = 1.2.0
build = 1.5.0
check-manifest = 0.51
click = 8.4.2
cmarkgfm = 2025.10.22
coverage = 7.8.2
cryptography = 50.0.2
cssselect = 1.4.0
decorator = 5.3.1
feedparser = 6.0.14
feedparser-sgmllib = 2.1.0
furl = 2.1.4
future = 1.0.0
gunicorn = 23.0.0
h11 = 0.16.0
id = 1.6.1
importlib-metadata = 9.0.1
importlib-resources = 6.5.2
iniconfig = 2.3.1
jaraco.classes = 3.4.0
jaraco.context = 6.1.2
jaraco.functools = 4.5.0
jeepney = 0.9.0
jsonschema = 4.26.0
jsonschema-specifications = 2025.9.1
keyring = 25.7.0
lxml = 5.4.0
lxml-html-clean = 0.4.4
manuel = 1.13.0
Markdown = 3.10.3
markdown-it-py = 3.0.0
mdurl = 0.1.2
mock = 5.2.0
more-itertools = 10.8.0
natsort = 8.4.0
nh3 = 0.3.7
orderedmultidict = 1.0.2
outcome = 1.3.0post0
overrides = 7.7.0
pep440 = 0.1.2
piexif = 1.1.3
pluggy = 1.6.0
prompt-toolkit = 3.0.53
psutil = 7.2.2
py = 1.11.0
PyJWT = 2.15.1
pyOpenSSL = 26.4.0
pyproject-hooks = 1.2.0
pyroma = 5.0.1
pyrsistent = 0.20.0
PySocks = 1.7.1
pytest = 9.2.0
pytest-cov = 6.3.0
python-dateutil = 2.9.0.post0
python-dotenv = 1.2.4
PyYAML = 6.0.3
readme-renderer = 44.0
referencing = 0.37.0
requests-toolbelt = 1.0.0
responses = 0.26.3
rfc3986 = 2.0.0
rich = 14.3.4
robotframework = 7.3.2
robotframework-assertion-engine = 3.0.3
robotframework-browser = 19.10.1
robotframework-debuglibrary = 2.5.0
robotframework-lsp = 1.13.0
robotframework-pythonlibcore = 4.4.1
# core tests do not use selenium anymore -> remove?
robotframework-selenium2library = 3.0.0
robotframework-selenium2screenshots = 0.8.1
robotframework-seleniumlibrary = 6.7.1
robotframework-seleniumtestability = 2.1.0
robotsuite = 3.0.1
rpds-py = 0.30.0
SecretStorage = 3.5.0
seedir = 0.5.1
selenium = 4.27.1
sgmllib3k = 1.0.0
simplejson = 3.20.2
sniffio = 1.3.1
sortedcontainers = 2.4.0
toml = 0.10.2
towncrier = 24.8.0
trio = 0.33.0
trio-websocket = 0.12.2
trove-classifiers = 2026.9.21.13
twine = 6.1.0
types-PyYAML = 6.0.12.20261103
types-toml = 0.10.8.20260518
typing-extensions = 4.15.0
tzdata = 2026.6
Unidecode = 1.4.0
urllib3-secure-extra = 0.1.0
watchdog = 6.0.0
wcwidth = 0.2.14
webresource = 1.2
websocket-client = 1.9.2
wrapt = 1.17.3
wsproto = 1.3.2
zipp = 3.23.1

[versions:python_version > "3.10"]
tomli = 2.4.1
pillow = 13.0.0
# Override of Zope pin for security fixes.  Needs Python 3.11+.
# You MUST manually keep this in sync with the version-overrides in mx.ini.
filelock = 4.2.8
# Override of Zope pin for security fixes.  7.6 and higher need Python 3.11+.
# You MUST manually keep this in sync with the version-overrides in mx.ini.
AccessControl = 7.7
# 9.0 removes bytes, sorted, tuple and zip from safe_builtins:
# AccessControl 7.7 adds guarded versions.  Needs Python 3.11+.
# You MUST manually keep this in sync with the version-overrides in mx.ini.
RestrictedPython = 9.0

[versions:python_version == "3.10"]
pillow = 12.3.0
# Newer filelock versions with security fixes need Python 3.11+.
# Newer versions that support 3.10 have more open vulnerabilities.
# You MUST manually keep this in sync with the version-overrides in mx.ini.
filelock = 3.29.0
# Override of Zope pin for security fixes.  Newer versions need Python 3.11+.
# You MUST manually keep this in sync with the version-overrides in mx.ini.
AccessControl = 7.5
# Override of Zope pin for security fixes.  Newer versions need Python 3.11+.
# You MUST manually keep this in sync with the version-overrides in mx.ini.
RestrictedPython = 8.5

[versions:windows]
pywin32-ctypes = 0.2.3

[versionannotations]
# keep this alphabetical please
cryptography =
    Since version 49 there are no wheels for x86_64 (Intel) macOS, only arm64.
    On Intel Macs pip builds it from source, which needs Rust and OpenSSL.
    In Plone core it is not installed on macOS, only via optional tooling.
grpcio =
   This has an exact version pin in the robotframework-browser package.
grpcio-tools =
   This has an exact version pin in the robotframework-browser package.
lxml =
    Keep lxml at 5.x for Plone 6.1.  Note that lxml 6.1.0 has a security fix
    (CVE-2026-41066): in lxml 5, iterparse() and ETCompatXMLParser() still
    resolve external entities by default, so untrusted XML can read local files.
    Plone core does not use those on untrusted XML, so it is not affected.
lxml-html-clean =
    Versions 0.4.5 and higher have a security fix, but need lxml 6.1.1 or higher.
    The fix (CVE-2026-49825) is about javascript: URLs in xlink:href when using
    Cleaner(safe_attrs_only=False).  The safe_html transform of
    Products.PortalTransforms is not affected: it uses safe_attrs_only=True and
    already removes attributes with script: or data: in their value.
prompt-toolkit =
    Requirement of robotframework-debuglibrary: prompt-toolkit<3,>=2
protobuf =
   This has an exact version pin in the robotframework-browser package.
tomli =
    Zope 5.14.2 only has a pin for tomli (2.2.1) on Python 3.10