Summary

• Introduces requirements.in and requirements-build.in as pip-tools source files listing direct dependencies
• Regenerates requirements.txt and requirements-build.txt with full transitive dependency pinning and SHA-256 hashes via pip-compile --generate-hashes
• Addresses SC-003 / CWE-1357: transitive dependencies were unpinned and unauditable

Findings addressed

Remediation applied: Adopted pip-tools (pip-compile --generate-hashes). Added requirements.in and requirements-build.in as source manifests; the generated lockfiles now pin every transitive dependency to an exact version with multi-platform SHA-256 hashes, making the dependency tree fully auditable.

To regenerate lockfiles after updating direct dependencies:

pip install pip-tools
pip-compile --generate-hashes requirements.in -o requirements.txt
pip-compile --generate-hashes requirements-build.in -o requirements-build.txt

Skipped findings

None.

Local verification

• pip-compile --generate-hashes completed successfully for both lockfiles
• 4 files changed: 2 new .in source files, 2 updated lockfiles with hashes for all transitive deps
• Test suite collection errors are pre-existing (missing six in CI env, unrelated to this change)

Part of story VC-53600 / epic VC-53597.