pyproject.toml

[project]
name = "cdedb2"
version = "2.1.0"
requires-python = ">=3.13,<3.14"
dependencies = [
    "babel==2.17.0",
    "bleach==6.2.0",
    "click==8.2.0",
    "coverage==7.6.0",
    "cssselect==1.3.0",
    "cryptography==46.0.6",
    "freezegun==1.5.1",
    "graphviz==0.20.2",
    "gunicorn==23.0.0",
    "jinja2==3.1.6",
    "ldap3==2.9.1",
    "legacy-cgi; python_version >= '3.13'",
    "lxml==5.4.0",
    "mailmanclient==3.3.5",
    "markdown==3.8.1",
    "passlib==1.7.4",
    "phonenumbers==8.12.57",
    "pillow==12.1.1",
    "psycopg2-binary==2.9.10",
    "pyicu==2.14",
    "pyparsing==3.1.2",
    "python-dateutil==2.9.0",
    "python-magic==0.4.27",
    "pytz==2025.2",
    "schulze-condorcet==2.0.1",  # not in debian
    "segno==1.6.6",
    "sphinx==8.1.3",
    "sphinx-rtd-theme==3.0.2",
    "subman==0.1.1",  # not in debian
    "cysystemd==2.0.5",
    "tabulate==0.9.0",
    "typing-extensions==4.15.0",
    "webtest==3.0.6",  # This is more up-to-date than trixie.
    "werkzeug==3.1.6",
    "zxcvbn==4.5.0",  # not in trixie.
]

[dependency-groups]
dev = [
    "mypy==1.19.1",
    "lxml-stubs",
    "ruff==0.15.7",
    "types-bleach",
    "types-ldap3",
    "types-Markdown",
    "types-passlib",
    "types-Pillow",
    "types-psycopg2",
    "types-python-dateutil",
    "types-tabulate",
    "types-zxcvbn",
]
# Excluded from dev to ensure better docker cache.
# Make sure to bump the version in Dockerfile-cdedb!
playwright = [
    "playwright==1.55.0",
]
# dependencies for the cdedb-ldap interface
ldap = [
    "ldaptor==21.2.0",
    "psycopg[binary,pool]==3.2.12",
]

[build-system]
requires = ["uv_build"]
build-backend = "uv_build"

[tool.uv.build-backend]
module-name = "cdedb"
module-root = ""

[tool.uv]
exclude-newer = "14 days"

[tool.uv.exclude-newer-package]
# Critical infrastructure packages we want to allow timely security updates for.
gunicorn = "1 day"
passlib = "1 day"
werkzeug = "1 day"

# We only use this internally so this isn't critical.
#  Renovate doesn't know that though and this reduces PR spam.
cryptography = "1 day"

# Our first party packages. If they are updated we probably want that update right away.
subman = "1 minute"
schulze-condorcet = "1 minute"

[tool.ruff]
target-version = "py313"
line-length = 88
preview = true
output-format = "concise"
src = ["cdedb", "tests"]

include = ["pyproject.toml", "cdedb/**/*.py", "tests/**/*.py"]

[tool.ruff.format]
exclude = [
    "cdedb/database/evolutions/archive/**/*.py",
]
quote-style = "preserve"

[tool.ruff.lint]
select = [
    "F",  # pyflakes
    "E",  # pycodestyle errors
    "W",  # pycodestyle warnings
#    "C90",  # mccabe  # Reports a couple of places of over complex code.
#    "I",  # isort  # Run separately.
#    "N",  # pep8-naming  # Reports a few things most of which make sense to ignore.
#    "D",  # pydocstyle  # A whole bunch of complaints. Should be tackled per file if at all.
    "UP",  # pyupgrade  # Upgrades to new syntax. Mostly autofixable.
    "YTT",  # flake8-2020  # Detects misuse of `sys.version` for python3.10.
#    "ANN",  # flake8-annotations  # Reports many instances of missing __init__ returns, and a few complicated cases.
#    "S",  # flake8-bandit  # Reports some interesting things but plenty false positives.
#    "BLE",  # flake8-blind-except  # Mostly false positives.
#    "B",  # flake8-bugbear
#    "A",  # flake8-builtins  # Doesn't report much but seems useful.
    "COM",  # flake8-commas  # Enforces consistent trailing commas. Autofixable.
    "PLE",  # pylint errrors.
    "PLW",  # pylint warnings.
    "PLC",  # pylint conventions.
    "PLR",  # pylint refactoring suggestions.
    "RUF100",
]
ignore = [
    "F405", # * import.
    "E226", # Whitespace around arithmetic operator.
    "E501", # Line too long.
    "E731", # Assigning a lambda.
    "S101",  # Use of assert.
    "ANN401",  # Use of typing.Any.
    "S608",  # SQL-Injection vector due to query string construction.
    "A003",  # Class attributes shadowing builtin.
    "TRY003",  # Exception message not defined in exception class.
    "PLW2901",  # redefining for loop variable.
    "PLW1641",  # non hashable child class.
    "PLR09",  # Too many things in classes.
    "PLR1702",  # Too many nested blocks.
    "PLR6301",  # Method could be static.
    "PLR2004",  # Magic value comparison.
    "COM812",  # Enforced trailing commas. Disabled due to incompatibility with ruff format.
    "UP040",
    "UP045",
    "UP046",
    "UP047",
]
[tool.ruff.lint.per-file-ignores]
"tests/frontend_tests/__init__.py" = ["F401"]
"tests/backend_tests/__init__.py" = ["F401"]
"tests/ldap_tests/__init__.py" = ["F401"]
"tests/other_tests/__init__.py" = ["F401"]

[tool.ruff.lint.pydocstyle]
convention = "google"

[tool.ruff.lint.isort]
known-third-party = ["subman"]
known-first-party = ["cdedb", "tests"]
combine-as-imports = true

[tool.mypy]
python_version = "3.13"
show_error_codes = true
#show_error_context = true
enable_error_code = "ignore-without-code"

allow_redefinition = true
check_untyped_defs = true
disallow_any_generics = true
disallow_incomplete_defs = true
disallow_untyped_defs = true
warn_redundant_casts = true
warn_no_return = true
warn_unreachable = true
warn_unused_ignores = true
enable_incomplete_feature = [
    "TypeForm",
]
#This has way too many false positives, due to CdEDBObject = Dict[str, Any]
#warn_return_any = true

local_partial_types = true

modules = ["bin"]
packages = ["cdedb", "tests"]

[[tool.mypy.overrides]]
module = [
    # general
    "icu",
    "systemd.*",
    "cgitb",
    # ldap
    "ldaptor.*",
    # frontend
    "mailmanclient.*",
    "graphviz.*",
    # tests
    "webtest",
    "webtest.utils",
]
ignore_missing_imports = true