### WARNING: OpenStack makes no security guarantees about third-party

### dependencies listed here, and does not keep track of any

### vulnerabilities they contain. Versions of these dependencies are

### frozen at each coordinated release in order to stabilize upstream

### testing, and can contain known vulnerabilities. Consumers are

### *STRONGLY* encouraged to rely on curated distributions of OpenStack

### or manage security patching of dependencies themselves.

## section:general

a2wsgi # Apache-2.0

aiomysql # MIT License

aiosqlite # MIT License

alembic!=1.2.0,!=1.6.3 # MIT

amqp!=2.1.4,!=5.0.4 # BSD

anycrc # Zlib

apscheduler # MIT License

autobahn # MIT License

automaton # Apache-2.0

autopage # Apache-2.0

awscurl # MIT

Babel!=2.4.0 # BSD

bcrypt # Apache-2.0

beautifulsoup4 # MIT

betamax # Apache-2.0

boto # MIT

boto3 # Apache-2.0

botocore # Apache-2.0

cachetools # MIT License

cassandra-driver!=3.6.0 # Apache-2.0

cffi # MIT

cheroot # BSD

cmd2!=0.8.3 # MIT

confluent-kafka!=1.4.0 # Apache-2.0

confspirator # Apache-2.0

construct # MIT

cotyledon # Apache-2.0

croniter # MIT License

cryptography!=2.0 # BSD/Apache-2.0

cursive # Apache-2.0

datetimerange # MIT

decorator # BSD

defusedxml # PSF

django-compressor # MIT

django-debreach # BSD

django-formtools # BSD

Django<6 # BSD

# eventlet is not compatibile with 2.0.0: https://github.com/eventlet/eventlet/issues/619

dnspython!=2.0.0,!=2.2.0 # http://www.dnspython.org/LICENSE

dogpile.cache!=0.9.1,!=1.1.7 # BSD

dogtag-pki # LGPLv3+

dulwich!=0.19.3,!=0.19.7 # Apache-2.0

edgegrid-python # Apache-2.0

elasticsearch # Apache-2.0

enmerkar # BSD

# NOTE: New versions of eventlet should not be accepted lightly

# as they have earned a reputation of frequently breaking things.

eventlet!=0.18.3,!=0.20.1,!=0.21.0,!=0.23.0,!=0.25.0,!=0.32.0,!=0.34.1,!=0.34.2,!=0.34.3,!=0.35.0,!=0.36.0 # MIT

exabgp!=4.0.6 # BSD

falcon # Apache-2.0

# https://github.com/harlowja/fasteners/issues/36

fasteners!=0.15,!=0.16 # Apache-2.0

Flask!=0.11 # BSD

Flask-RESTful # BSD

GitPython # BSD License (3 clause)

google-api-python-client # Apache-2.0

graphviz!=0.5.0 # MIT License

greenlet!=0.4.14 # MIT

grpcio # Apache-2.0

gunicorn # MIT

httplib2 # MIT

httpx # BSD

Hypercorn # MIT

hvac # Apache-2.0

icalendar # BSD

# Do not make importlib-metadata conditional on Python version: we depend on

# newer code than in [most] releases of the Python std library.

importlib-metadata # Apache-2.0

infinisdk # BSD-3

influxdb!=5.3.0 # MIT

influxdb-client # MIT

infoblox-client # Apache-2.0

iso8601 # MIT

Jinja2 # BSD License (3 clause)

jira # BSD License (2 clause)

jmespath # MIT

jsonpatch!=1.20 # BSD

jsonschema # MIT

kazoo # Apache-2.0

kombu!=4.0.2 # BSD

kubernetes # Apache-2.0

ldappool # MPL

libsass # MIT

libvirt-python!=4.1.0,!=4.2.0 # LGPLv2+

lxml!=3.7.0 # BSD

Mako # MIT

msgpack # Apache-2.0

munch # MIT

ncclient # Apache-2.0

netaddr # BSD

netifaces!=0.10.0,!=0.10.1 # MIT

netmiko # MIT

networkx!=2.8.4 # BSD

oauthlib # BSD

opentelemetry-exporter-otlp # Apache-2.0

opentelemetry-exporter-otlp-proto-grpc # Apache-2.0

opentelemetry-exporter-otlp-proto-http # Apache-2.0

opentelemetry-sdk # Apache-2.0

ovs # Apache-2.0

ovsdbapp # Apache-2.0

packaging!=20.5,!=20.6,!=20.7 # Apache-2.0

paramiko!=2.9.0,!=2.9.1 # LGPLv2.1+

passlib # BSD

Paste # MIT

PasteDeploy # MIT

pecan!=1.0.2,!=1.0.3,!=1.0.4,!=1.2,!=1.4.0 # BSD

pexpect!=3.3 # ISC License

Pillow # PIL License

Pint # BSD

platformdirs # MIT License

PrettyTable!=3.4.0 # BSD

prometheus-client # Apache-2.0

protobuf # BSD License (3 clause)

psutil # BSD

psycopg2 # LGPL/ZPL

pyasn1!=0.2.3 # BSD

pyasn1-modules # BSD

pycadf!=2.0.0 # Apache-2.0

pycdlib # LGPLv2+

PyECLib!=1.6.2,!=1.6.3 # BSD

pyghmi!=1.4.0,!=1.5.11 # Apache-2.0

PyJWT # MIT

pykmip # Apache 2.0 License

pymemcache!=1.3.0 # Apache 2.0 License

pymongo!=3.1 # Apache-2.0

PyMySQL # MIT License

pyOpenSSL # Apache-2.0

pyparsing # MIT

pyroute2!=0.5.4,!=0.5.5,!=0.7.1,!=0.9.1,!=0.9.2,!=0.9.3,!=0.9.4;sys_platform!='win32' # Apache-2.0 (+ dual licensed GPL2)

pysaml2!=4.0.3,!=4.0.4,!=4.0.5rc1,!=4.0.5,!=4.1.0,!=4.2.0,!=4.3.0,!=4.4.0,!=4.6.0 # Apache-2.0

pysnmp # BSD

pystache # MIT

# Only required for sasl/binary protocol

python-binary-memcached # MIT

python-dateutil # BSD

python-ldap # PSF

python-memcached # PSF

pytz # MIT

pyudev # LGPLv2.1+

PyYAML # MIT

pyzabbix # LGPL

pyzmq # LGPL+BSD

qrcode # BSD

rbd-iscsi-client # Apache-2.0

redis!=4.0.0 # MIT

requests!=2.20.0,!=2.24.0 # Apache-2.0

requests-kerberos # ISC

retrying!=1.3.0 # Apache-2.0

rfc3986 # Apache-2.0

Routes # MIT

rtslib-fb # Apache-2.0

ruamel.yaml # MIT

salt!=2019.2.1,!=2019.2.2 # Apache-2.0

scikit-learn # BSD

scipy # BSD

semantic-version # BSD

setproctitle # BSD

SQLAlchemy # MIT

sshtunnel # MIT

statsd # MIT

suds-community # LGPLv3+

sushy!=1.9.0 # Apache-2.0

sympy # BSD

systemd-python # LGPLv2+

sysv-ipc # BSD License

tabulate # MIT

tenacity # Apache-2.0

uhashring # BSD

urllib3 # MIT

valkey # MIT

voluptuous # BSD License

warlock # Apache-2.0

WebOb # MIT

websocket-client # LGPLv2+

websockify # LGPLv3

Werkzeug!=2.2.0 # BSD License

wrapt # BSD License

xattr;sys_platform!='win32' # MIT

xmltodict # MIT

XStatic # MIT License

XStatic-Angular # MIT License

XStatic-Angular-Bootstrap # MIT License

XStatic-Angular-FileUpload # MIT License

XStatic-Angular-Gettext # MIT License

XStatic-Angular-lrdragndrop # MIT License

XStatic-Angular-Schema-Form # MIT

xstatic-angular-uuid # MIT License

xstatic-angular-vis # MIT License

XStatic-Bootstrap-Datepicker # Apache 2.0 License

XStatic-Bootstrap-SCSS # Apache 2.0 License

XStatic-bootswatch # MIT License

XStatic-D3 # BSD License (3 clause)

xstatic-filesaver # MIT License

XStatic-Font-Awesome # SIL OFL 1.1 License, MIT License

XStatic-Hogan # Apache 2.0 License

XStatic-Jasmine # MIT License

XStatic-jQuery # MIT License

XStatic-JQuery-Migrate # MIT License

XStatic-jquery-ui # MIT License

XStatic-JQuery.quicksearch # MIT License

XStatic-JQuery.TableSorter # MIT License

xstatic-js-yaml # MIT License

XStatic-JSEncrypt # MIT License

xstatic-json2yaml # MIT License

XStatic-mdi # SIL OPEN FONT LICENSE Version 1.1

XStatic-objectpath # MIT

XStatic-Rickshaw # BSD License (prior)

XStatic-roboto-fontface # Apache 2.0 License

XStatic-smart-table # MIT License

XStatic-Spin # MIT License

XStatic-term.js # MIT License

XStatic-tv4 # MIT

# NOTE(anilvenkata): This is required for profiling oslo.service processes

Yappi!=0.98,!=0.99 # MIT

zeroconf # LGPL

zipp # MIT

zstd # BSD License (2 clause)

zVMCloudConnector;sys_platform!='win32' # Apache 2.0 License

## section:testing

bashate # Apache-2.0

beartype # MIT

coverage!=4.4 # Apache-2.0

ddt # MIT

docker # Apache-2.0

fixtures # Apache-2.0/BSD

freezegun # Apache-2.0

# NOTE(tkajinam): block 2.5.0 because of https://github.com/cdent/gabbi/issues/309

gabbi!=2.5.0 # Apache-2.0

keyring # MIT/PSF

# Do not make mock conditional on Python version: we depend on newer code than

# in [most] releases of the Python std library.

# https://github.com/testing-cabal/mock/issues/487 for 4.0.[0-1] denylist

mock!=4.0.0,!=4.0.1 # BSD

moto # Apache-2.0

mypy # MIT

nodeenv # BSD

openstack-doc-tools # Apache-2.0

os-testr # Apache-2.0

oslotest # Apache-2.0

pifpaf # Apache-2.0

playwright # Apache-2.0

psycopg2-binary # LGPL/ZPL

py-consul # MIT License

pytest # MIT

pytest-cov # MIT

pytest-django # BSD (3 clause)

pytest-html #MPL-2.0

pytest-subtests # MIT

pytest-xdist # MIT

python-subunit # Apache-2.0/BSD

requests-mock # Apache-2.0

respx # BSD-3-Clause

selenium # Apache-2.0

stestr!=2.3.0,!=3.0.0 # Apache-2.0

testrepository # Apache-2.0/BSD

testresources # Apache-2.0/BSD

testscenarios # Apache-2.0/BSD

testtools # MIT

typing-extensions # PSF

tzdata # MIT

virtualbmc # Apache-2.0

virtualenv!=16.3.0 # MIT

WebTest # MIT

whereto # Apache-2.0

wsgi-intercept # MIT License

xvfbwrapper #license: MIT

## section:docs

blockdiag!=2.0.0 # Apache-2.0

doc8 # Apache-2.0

docutils # OSI-Approved Open Source, Public Domain

pydot # MIT License

pydotplus # MIT License

Pygments # BSD license

rst2txt # BSD

sphinx!=1.6.6,!=1.6.7,!=2.1.0,!=3.0.0,!=3.4.2 # BSD

sphinx-copybutton # MIT

sphinxcontrib-actdiag # BSD

sphinxcontrib-apidoc # BSD

sphinxcontrib-blockdiag # BSD

sphinxcontrib-httpdomain # BSD

sphinxcontrib-nwdiag # BSD

sphinxcontrib-pecanwsme # Apache-2.0

sphinxcontrib-programoutput # BSD license

sphinxcontrib-seqdiag # BSD

sphinxcontrib-svg2pdfconverter # BSD License

sphinxcontrib.datatemplates # BSD License

## section:openstack-general

##

## Projects under openstack governance (excluding clients and docs, which

## have their own section)

castellan # Apache-2.0

# ceilometermiddleware might not show up with a search of setup.cfg and

# requirements files, but some projects use it via being installed by devstack

ceilometermiddleware # Apache-2.0

cliff!=2.9.0,!=2.17.0 # Apache-2.0

debtcollector # Apache-2.0

diskimage-builder!=1.6.0,!=1.7.0,!=1.7.1 # Apache-2.0

etcd3gw!=0.2.2,!=0.2.3,!=0.2.6 # Apache-2.0

futurist # Apache-2.0

glance-store!=0.29.0 # Apache-2.0

heat-translator # Apache-2.0

horizon # Apache-2.0

ironic-lib!=4.6.0 # Apache-2.0

keystoneauth1 # Apache-2.0

keystonemiddleware # Apache-2.0

kuryr-lib # Apache-2.0

lark # MIT

metalsmith # Apache-2.0

microversion-parse # Apache-2.0

mistral-lib # Apache-2.0

networking-bagpipe # Apache-2.0

networking-bgpvpn # Apache-2.0

networking-generic-switch # Apache-2.0

networking-l2gw # Apache-2.0

networking-sfc # Apache-2.0

neutron # Apache-2.0

neutron-dynamic-routing # Apache-2.0

neutron-fwaas # Apache-2.0

neutron-lib # Apache-2.0

octavia-lib # Apache-2.0

os-apply-config # Apache-2.0

os-brick!=2.8.0 # Apache-2.0

os-client-config # Apache-2.0

os-collect-config # Apache-2.0

os-ken!=2.11.0,!=2.11.1 # Apache-2.0

os-refresh-config # Apache-2.0

os-resource-classes # Apache-2.0

os-service-types # Apache-2.0

os-traits # Apache-2.0

os-vif!=1.8.0,!=1.12.0,!=3.0.0 # Apache-2.0

osc-lib # Apache-2.0

osc-placement # Apache-2.0

oslo.cache!=1.31.1,!=2.1.0 # Apache-2.0

oslo.concurrency # Apache-2.0

oslo.config!=4.3.0,!=4.4.0 # Apache-2.0

oslo.context # Apache-2.0

oslo.db # Apache-2.0

oslo.i18n # Apache-2.0

oslo.limit # Apache-2.0

oslo.log!=3.44.2,!=4.1.2,!=4.2.0,!=5.0.1,!=5.0.2,!=5.1.0 # Apache-2.0

oslo.messaging!=9.0.0 # Apache-2.0

oslo.metrics # Apache-2.0

oslo.middleware # Apache-2.0

oslo.policy!=3.0.0,!=3.6.1 # Apache-2.0

oslo.privsep # Apache-2.0

oslo.reports # Apache-2.0

oslo.rootwrap # Apache-2.0

# NOTE(mriedem): oslo.serialization 2.19.1 is blocked for bug 1593641

oslo.serialization!=2.19.1 # Apache-2.0

oslo.service!=1.28.1,!=4.5.0 # Apache-2.0

oslo.upgradecheck # Apache-2.0

# NOTE(lajoskatona): oslo.utils version between 3.39.1 and 3.40.1 excluded due to bug 1812922

oslo.utils!=3.39.1,!=3.40.0,!=3.40.1 # Apache-2.0

oslo.versionedobjects # Apache-2.0

oslo.vmware # Apache-2.0

osprofiler # Apache-2.0

pbr!=2.1.0 # Apache-2.0

sherlock # MIT

stevedore!=3.0.0 # Apache-2.0

tap-as-a-service # Apache-2.0

taskflow!=6.0.0 # Apache-2.0

tempest # Apache-2.0

tooz # Apache-2.0

tosca-parser # Apache-2.0

WSME # MIT

yaql # Apache 2.0 License

## section:openstack-clients

##

## Clients for openstack services. None of these should have an upper bound

## as that has implications for testing in the gate.

aodhclient # Apache-2.0

gnocchiclient # Apache-2.0

openstacksdk # Apache-2.0

python-barbicanclient # Apache-2.0

python-blazarclient # Apache-2.0

python-cinderclient!=4.0.0 # Apache-2.0

python-cloudkittyclient # Apache-2.0

python-cyborgclient # Apache-2.0

python-designateclient # Apache-2.0

python-freezerclient # Apache-2.0

python-glanceclient # Apache-2.0

python-heatclient # Apache-2.0

python-ironic-inspector-client # Apache-2.0

python-ironicclient!=2.5.2,!=2.7.1,!=3.0.0 # Apache-2.0

python-keystoneclient!=2.1.0 # Apache-2.0

python-magnumclient # Apache-2.0

python-manilaclient # Apache-2.0

python-masakariclient # Apache-2.0

python-mistralclient!=3.2.0 # Apache-2.0

python-neutronclient # Apache-2.0

python-novaclient # Apache-2.0

python-observabilityclient # Apache-2.0

python-octaviaclient # Apache-2.0

python-openstackclient!=7.3.0,!=7.3.1 # Apache-2.0

python-swiftclient # Apache-2.0

python-tackerclient # Apache-2.0

python-troveclient # Apache-2.0

python-watcherclient # Apache-2.0

python-zaqarclient # Apache-2.0

python-zunclient # Apache-2.0

## section:openstack-docs

##

## Docs-related projects under openstack governance

openstackdocstheme!=2.1.0,!=2.1.1 # Apache-2.0

os-api-ref # Apache-2.0

reno # Apache-2.0

sphinx-feature-classification # Apache-2.0

zuul-sphinx # Apache-2.0

## section:openstack-testing

##

## Projects under openstack governance (excluding clients, which have their

## own section)

# NOTE(dhellmann): We need to include this package for testing the

# release jobs that propose constraint updates, even though it is not

# a real requirement of any of our software.

openstack-release-test # Apache-2.0

## section:cinder-libs

##

## Third party libraries for cinder storage drivers

dfs-sdk # Apache-2.0

distro # Apache-2.0

hpe-storage-flowkit-py # Apache-2.0

krest # Apache-2.0

py-pure-client # BSD

python-3parclient # Apache-2.0

python-linstor # LGPLv3

pywbem # LGPLv2.1+

rsd-lib # Apache-2.0

storops # Apache-2.0

storpool!=5.2.0,!=5.3.0 # Apache-2.0

storpool.spopenstack # Apache-2.0

## section:internal

##

## Tooling-related caps and denylists.

pip # MIT

# While setuptools cannot deal with pre-installed incompatible versions,

# setting a lower bound is not harmful - it makes error messages cleaner. DO

# NOT set an upper bound on setuptools, as that will lead to uninstallable

# situations as progressive releases of projects are done.

# Denylist setuptools 34.0.0-34.3.2 due to https://github.com/pypa/setuptools/issues/951

# Denylist setuptools 36.2.0 due to https://github.com/pypa/setuptools/issues/1086

# Denylist setuptools 48.0.0, 49.0.0 due to https://github.com/pypa/setuptools/issues/2232

setuptools!=24.0.0,!=34.0.0,!=34.0.1,!=34.0.2,!=34.0.3,!=34.1.0,!=34.1.1,!=34.2.0,!=34.3.0,!=34.3.1,!=34.3.2,!=36.2.0,!=48.0.0,!=49.0.0 # PSF/ZPL

wheel # MIT

## section:deprecated

##

## Libraries that are no longer supported upstream and which we should

## work to remove usage of.

jsonpath-rw # Apache-2.0

jsonpath-rw-ext # Apache-2.0

python-consul2 # MIT License

simplejson # MIT