pyproject.toml

Rama dev · réplica de lectura del repositorio original.

[build-system]
requires = ["setuptools>=84.2.1", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "vlog"
version = "0.1.0"
description = "Self-hosted video platform with 4K support and HLS streaming"
readme = "README.md"
requires-python = ">=3.12"
dependencies = [
    "fastapi>=0.162.0",
    "uvicorn[standard]>=0.54.0",
    "python-multipart>=0.0.33",
    "asyncpg>=0.32.0",
    "databases[postgresql]>=0.9.0",
    "psycopg2-binary>=2.9.13",
    "sqlalchemy>=2.0.54",
    "alembic>=1.20.1",
    "python-slugify>=9.1.3",
    "python-dateutil>=4.0.0",  # Required for partition management
    "aiofiles>=25.1.0",
    "httpx>=0.28.1",
    "faster-whisper>=1.2.1",
    "watchdog>=6.0.0",
    "slowapi>=0.1.10",
    "rich>=15.0.0",
    "redis>=8.1.0",  # Required for job queue and pub/sub
    "sse-starlette>=3.6.0",  # Server-Sent Events support
    "prometheus-client>=0.26.0",  # Prometheus metrics
    "psutil>=7.2.2",  # System resource monitoring for sprite worker
    "Pillow>=12.3.0",  # Image processing for thumbnail uploads (security hardening)
    "bleach>=6.4.0",  # Comment sanitization
    "boto3>=1.43.122",  # S3 backups
    "filelock>=4.2.4",  # Patched for all supported runtimes
    "argon2-cffi>=25.1.0",  # Secure API key hashing (Issue #445)
    "email-validator>=2.3.0",  # Pydantic EmailStr validation (Issue #200)
    "authlib>=1.9.1",  # OIDC integration (Issue #200)
    # Security patches for transitive dependencies
    "jaraco-context>=6.1.2",  # GHSA-58pv-8j8x-9vj2 path traversal vulnerability
    "wheel>=0.48.0",  # CVE-2026-24049 privilege escalation vulnerability
    "urllib3>=2.8.0",  # GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53, GHSA-pq67-6m6q-mj2v
    "cryptography>=50.0.2",  # GHSA-537c-gmf6-5ccf vulnerable OpenSSL bundled in wheels (via authlib)
    "python-json-logger>=4.2.0",  # Structured JSON logging (Issue #208)
]

[project.optional-dependencies]
dev = [
    "pytest>=9.2.0",
    "pytest-xdist>=3.8.0",
    "pytest-asyncio>=1.4.1",
    "pytest-cov>=7.1.0",
    "ruff>=0.17.4",
]

[project.scripts]
vlog = "cli.main:main"

[tool.setuptools.packages.find]
include = ["api*", "worker*", "cli*", "backup*"]
where = ["."]

[tool.setuptools]
py-modules = ["config", "code_version"]

[tool.setuptools.package-data]
"*" = ["py.typed"]

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = "test_*.py"
python_classes = "Test*"
python_functions = "test_*"
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"
addopts = "-v --tb=short --cov=api --cov=worker --cov=cli --cov-report=html --cov-report=term-missing"
filterwarnings = [
    "ignore::DeprecationWarning",
    "ignore::PendingDeprecationWarning",
]
markers = [
    "slow: marks test as slow (deselect with '-m \"not slow\"')",
    "integration: marks test as integration test",
]

[tool.coverage.run]
source = ["api", "worker", "cli"]
omit = [
    "*/tests/*",
    "*/migrations/*",
    "*/__init__.py",
]

[tool.coverage.report]
precision = 2
skip_empty = true
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "raise AssertionError",
    "raise NotImplementedError",
    "if __name__ == .__main__.:",
    "if TYPE_CHECKING:",
    "@abstract",
]

[tool.coverage.html]
directory = "htmlcov"

[tool.ruff]
line-length = 120
target-version = "py312"

[tool.ruff.lint]
select = ["E", "F", "W", "I"]
ignore = ["E501"]  # Line too long (handled by formatter)