requirements.txt

# =============================================================================
# Python Requirements for Makeability Lab Website
# =============================================================================
#
# Run `pip3 install -r requirements.txt` to install dependencies
#
# Compatible with: Python 3.13.x, Django 5.2.x
#
# If you want to view the installed Python packages on the Docker container:
# 1. Make sure the Makeability Lab website container is running
# 2. From command line, run: > docker exec -it makeabilitylabwebsite-website-1 bash
# 3. Now you're in the Docker container, run: apache@eee162a179fd:/code$ pip3 list
# 4. Confirm that all of the packages that you expect to be installed are there.
#
# If you need to install new packages in the Docker container, you can try:
# 1. docker ps // this gets a list of current processes/containers running
# 2. docker exec -it -u root <container_id> /bin/bash
# 3. Then here, you can install a new package like: > pip3 install django==5.2.15
#    or you could even run: > pip3 install -r requirements.txt
#
# You can also try to see which version of libraries are installed by running:
# 1. docker run -it makelab_image bash
# 2. pip3 list
# Or even commands like: python -m django --version
#
# =============================================================================
# UPGRADE NOTES (December 2025)
# =============================================================================
# Upgraded from Django 4.2.16 to Django 5.2.9 (LTS)
# Upgraded from Python 3.11.6 to Python 3.13.x
#
# Key Django 5.2 changes to be aware of:
# - PostgreSQL 14+ required (we use PostgreSQL 16, so we're good)
# - MySQL connections now default to utf8mb4 character set
# - See: https://docs.djangoproject.com/en/5.2/releases/5.2/
# =============================================================================

# -----------------------------------------------------------------------------
# Core Framework
# -----------------------------------------------------------------------------
# Django 5.2 is an LTS release with support until April 2028
# See: https://www.djangoproject.com/download/
django==5.2.15

# -----------------------------------------------------------------------------
# Database
# -----------------------------------------------------------------------------
# PostgreSQL adapter - the most popular PostgreSQL database adapter for Python
# Note: psycopg2 requires libpq-dev and python3-dev for building from source
# See: https://pypi.org/project/psycopg2/
psycopg2==2.9.11

# -----------------------------------------------------------------------------
# Development & Debugging
# -----------------------------------------------------------------------------
# Django Debug Toolbar - useful for debugging queries, templates, etc.
# See: https://django-debug-toolbar.readthedocs.io/en/latest/
django-debug-toolbar==5.0.1

# Django REST Framework - for API endpoints
# See: https://www.django-rest-framework.org/
djangorestframework==3.15.2

# -----------------------------------------------------------------------------
# Image Processing
# -----------------------------------------------------------------------------
# Wand - ImageMagick binding for Python, used for PDF thumbnails
# See: https://pypi.org/project/Wand/
wand==0.6.13

# pypdf - pure-Python PDF library, used to auto-count a publication's pages
# (issue #1298) by reading the PDF's page tree directly (no rendering).
# See: https://pypi.org/project/pypdf/
pypdf==6.14.2

# Pillow - Python Imaging Library fork, for image manipulation
# Note: Pillow 10.0+ dropped Python 3.7 support; 11.0+ dropped Python 3.8
# See: https://pypi.org/project/Pillow/
Pillow==12.3.0

# Image cropping in the admin is provided by the in-repo `image_cropping/`
# package (a fork of django-image-cropping), NOT a PyPI dependency. We dropped
# django-image-cropping==1.7 (Feb 2022, EOL Jcrop+jQuery, Django <=4.0) in favor
# of a modern Cropper.js widget that previews/crops before saving. See #1299 /
# #1269 and image_cropping/README.md. (django-appconf was a transitive dep of
# that package and is no longer needed.)

# Easy Thumbnails - thumbnail generation, works with the in-repo image_cropping
# See: https://pypi.org/project/easy-thumbnails/
easy_thumbnails==2.10.1

# -----------------------------------------------------------------------------
# Admin & Forms
# -----------------------------------------------------------------------------
# Sorted Many-to-Many Field - for sortable M2M relationships
# Note: Version 4.0.0 is required for Django 5.x compatibility
# The built-in drag-and-drop admin widget still works; we just can't use
# the filter_horizontal-style widget (django-sortedm2m-filter-horizontal-widget)
# because it's unmaintained and incompatible with sortedm2m 4.x
# See: https://pypi.org/project/django-sortedm2m/
django-sortedm2m==4.0.0

# NOTE: django-sortedm2m-filter-horizontal-widget has been REMOVED
# It requires django-sortedm2m<4.0.0, which doesn't support Django 5.x
# If you need the filter_horizontal styling, you'll need to either:
#   1. Fork and update the widget package yourself
#   2. Stay on Django 4.2 LTS (supported until April 2026)

# django-prose-editor - ProseMirror-based rich text editor for the News admin
# (issue #1269). Replaced django-ckeditor (CKEditor 4), which was EOL with
# unpatched XSS and blocked the Django 6.1 LTS upgrade. MIT-licensed, no editor
# licensing/branding regime. The [sanitize] extra pulls in nh3, which we use for
# server-side HTML sanitization derived from the enabled editor extensions
# (ProseEditorField(..., sanitize=True) on website/models/news.py).
# See: https://pypi.org/project/django-prose-editor/
django-prose-editor[sanitize]==0.26.0


# -----------------------------------------------------------------------------
# WSGI Server (production)
# -----------------------------------------------------------------------------
# Gunicorn is the production WSGI server. We previously ran Django's dev
# `runserver` on test AND prod, which the Django docs explicitly warn against
# ("DO NOT USE THIS SERVER IN A PRODUCTION SETTING ... has not gone through
# security audits or performance tests"). See issue #1034.
#
# Gunicorn runs inside the same container behind UW CSE's Apache reverse proxy
# (Apache still serves /static/ and /media/ directly and proxies dynamic
# requests to 127.0.0.1:8571 -> container :8000), so this swap is contained to
# the container and ships via the normal push-to-deploy path -- no Apache or
# UW CSE IT changes required. Worker count and request timeout are tunable via
# the GUNICORN_WORKERS / GUNICORN_TIMEOUT env vars in docker-entrypoint.sh.
# See: https://docs.djangoproject.com/en/5.2/howto/deployment/wsgi/gunicorn/
gunicorn==23.0.0

# concurrent-log-handler - multiprocess-safe rotating file log handler, used by
# LOGGING['handlers']['file'] in settings.py. Gunicorn's 3 workers each open the
# same media/debug.log, and the stdlib RotatingFileHandler is not
# multiprocess-safe: workers raced on rollover and silently lost log records
# (issue #1439). This handler takes a cross-process file lock (via its
# portalocker dependency) around every write and rollover.
concurrent-log-handler==0.9.29

# -----------------------------------------------------------------------------
# Security & Networking
# -----------------------------------------------------------------------------
# pyOpenSSL - Python wrapper around OpenSSL
pyOpenSSL==26.0.0

# Requests - HTTP library for Python
requests==2.33.0

# -----------------------------------------------------------------------------
# Testing
# -----------------------------------------------------------------------------
# factory_boy - model fixtures for the test suite (#1272). The de-facto Django
# standard; we use explicit factories (website/tests/factories.py) over
# model_bakery because they're easier to debug with our M2M / SortedManyToMany /
# ProjectRole-through relationship graph. Pulls in Faker (pinned below) as a dep.
# See: https://factoryboy.readthedocs.io/
factory_boy==3.3.3

# Faker - realistic fake data (names, sentences, dates) used by the factories.
# Dependency of factory_boy; pinned explicitly so test data stays reproducible.
# See: https://faker.readthedocs.io/
Faker==40.23.0