fix: pin dependencies to exact versions using pip-tools

Makefile

@@ -1,6 +1,6 @@
 .ONESHELL:
 
-.PHONY: run test covers install-deps dev docker lint frontend clean all
+.PHONY: run test covers install-deps update-deps dev docker lint frontend clean all
 
 prod-run:
 	gunicorn cre:app --log-file=-
@@ -60,6 +60,9 @@ test:
 cover:
 	. ./venv/bin/activate && FLASK_APP=cre.py FLASK_CONFIG=testing flask test --cover
 
+update-deps:
+	pip install pip-tools && pip-compile requirements.in --output-file requirements.txt --strip-extras
+
 install-deps-python:
 	[ -d "./venv" ] && . ./venv/bin/activate &&\
 	pip install --upgrade pip setuptools &&\

docs/developmentSetup.md

@@ -102,6 +102,23 @@ To edit files it is suggested that a code editor such as Visual Studio Code is u
 OpenCRE depends on Makefiles to automate the setup and execution of several aspects.
 You can install the project by running `make install`.
 
+### Adding or updating Python dependencies
+
+Python dependencies are managed using [pip-tools](https://pip-tools.readthedocs.io/).
+
+- `requirements.in` — the human-maintained list of direct dependencies. **Edit this file** when adding or removing a package.
+- `requirements.txt` — the auto-generated lockfile with all dependencies pinned to exact versions. **Do not edit this file directly.**
+
+After editing `requirements.in`, regenerate the lockfile with:
+
+```bash
+make update-deps
+```
+
+Then commit both `requirements.in` and `requirements.txt`.
+
+> **Note:** Run `make update-deps` using the same Python version as CI (Python 3.12.3) to ensure the lockfile is consistent with the test environment.
+
 ### Testing that everything works
 
 If the tests pass, the project should be operational. You can run tests with

requirements.in

@@ -0,0 +1,107 @@
+black==24.4.2 # do not touch, same version as superlinter
+click
+compliance-trestle
+coverage
+dacite
+Flask
+Flask_Caching
+flask_compress
+Flask_Cors
+Flask_Migrate
+Flask-SQLAlchemy
+setuptools
+gitpython
+google
+google-api-core
+google-auth-oauthlib
+google-cloud-aiplatform
+google-cloud-trace
+grpcio-status
+grpcio
+gspread
+gunicorn
+networkx
+nltk
+oauthlib
+openai
+playwright
+psycopg2-binary
+PyGithub
+python-markdown-maker
+scikit-learn
+scipy
+semver
+SQLAlchemy
+nose
+mypy
+numpy
+neo4j
+neomodel
+openapi-schema-validator
+openapi-spec-validator
+openpyxl
+orderedmultidict
+packaging
+paramiko
+pathable
+pathspec
+pbr
+pep517
+Pillow
+pip-autoremove
+platformdirs
+pluggy
+posthog
+prance
+prompt-toolkit
+proto-plus
+protobuf
+pyasn1
+pyasn1-modules
+pycodestyle
+pycparser
+pydantic
+pyee
+pyflakes
+PyJWT
+PyNaCl
+pyparsing
+pyrsistent
+PySnooper
+pytest
+pytest-base-url
+pytest-playwright
+python-dateutil
+python-dotenv
+python-frontmatter
+python-slugify
+PyYAML==6.0.1
+regex
+requests
+requests-oauthlib
+rfc3986
+rsa
+rq
+redis
+ruamel.yaml
+ruamel.yaml.clib
+Shapely
+six
+smmap
+sniffio
+soupsieve
+sqlalchemy-stubs
+testresources
+text-unidecode
+threadpoolctl
+toml
+tomli
+tqdm
+types-PyYAML
+typing-inspect
+typing_extensions
+untangle
+urllib3
+vertexai
+xmltodict
+alive-progress