Libraries/Build - unpin referencing library (#3919)

requirements.txt

@@ -1,27 +1,21 @@
-# eventlet>=0.38.0  # Removed - replaced with threading mode for better Python 3.12+ compatibility
 feedgen~=1.0
 feedparser~=6.0  # For parsing RSS/Atom feeds
 flask-compress
-# 0.6.3 included compatibility fix for werkzeug 3.x (2.x had deprecation of url handlers)
 flask-login>=0.6.3
 flask-paginate
-flask_restful
+flask-socketio>=5.6.1,<6 # Re #3910
+flask>=3.1,<4
 flask_cors # For the Chrome extension to operate
-# janus # No longer needed - using pure threading.Queue for multi-loop support
+flask_restful
 flask_wtf~=1.2
-flask-socketio>=5.5.0,<6
-python-socketio>=5.11.0,<6
-python-engineio>=4.9.0,<5
 inscriptis~=2.2
+python-engineio>=4.9.0,<5
+python-socketio>=5.11.0,<6
 pytz
 timeago~=1.0
 validators~=0.35
+werkzeug==3.1.6
 
-# 3910 - flask and werkzeug need pinning until Flask-SocketIO==5.6.1 is out
-# Then pin a version >= 5.6.1 so it doesnt come back
-# flask>=3.1,<4 should be in the future
-flask==3.0.3
-werkzeug==3.0.6
 
 # Set these versions together to avoid a RequestsDependencyWarning
 # >= 2.26 also adds Brotli support if brotli is installed
@@ -103,12 +97,8 @@ pytest ~=9.0
 pytest-flask ~=1.3
 pytest-mock ~=3.15
 
-# Anything 4.0 and up but not 5.0
-jsonschema ~= 4.26
-
 # OpenAPI validation support
-openapi-core[flask] >= 0.19.0
-
+openapi-core[flask] ~= 0.22
 
 loguru
 
@@ -130,8 +120,7 @@ greenlet >= 3.0.3
 # Default SOCKETIO_MODE=threading is recommended for better compatibility
 gevent
 
-# Previously pinned for flask_expects_json (removed 2026-02). Unpinning for now.
-referencing
+referencing  # Don't pin — jsonschema-path (required by openapi-core>=0.18) caps referencing<0.37.0, so pinning 0.37.0 forces openapi-core back to 0.17.2. Revisit once jsonschema-path>=0.3.5 relaxes the cap.
 
 # For conditions
 panzi-json-logic