chore(deps): remove packages nothing imports, declare direct imports, move mypy to test deps

Removed from requirements.txt: python-socketio, python-engineio,
websockets, websocket-client — zero imports anywhere in this repo, and
the one store plugin that needs Socket.IO (ledmatrix-music) declares it
in its own requirements.txt, which the plugin store installs. Removed
the same quartet plus timezonefinder, geopy, google-auth-oauthlib,
google-auth-httplib2, google-api-python-client, unidecode, icalevents,
python-dateutil, flask-wtf and the werkzeug pin from
web_interface/requirements.txt — all leftovers from the deleted built-in
weather/calendar/music displays (flask-wtf was doubly dead: app.py
explicitly disables CSRF and sets csrf=None). scripts/
install_dependencies_apt.py, which mirrors these lists for the
first-time installer, drops the same packages.

Added: urllib3 (imported directly in four core modules), jinja2 and
markupsafe (imported directly in pages_v3.py) — previously reachable
only as transitives. mypy moves from runtime requirements to
requirements-test.txt.

Verified in a fresh venv: all four requirements files co-install, pip
check is clean, the full CI-enrolled suite (907 tests) and a Flask boot
smoke pass with the trimmed dependency set.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SXb4mKcAkVaxkeTb3YnAdr

requirements-test.txt

@@ -7,3 +7,4 @@
 # pytest>=9.0.3,<10 and made the two files impossible to install together.
 # Only declare what requirements.txt doesn't already provide.
 freezegun>=1.2,<2        # deterministic time for golden-image tests
+mypy>=1.5.0,<2.0.0       # static type checking (also pinned in .pre-commit-config.yaml)

requirements.txt

@@ -11,27 +11,22 @@ pytz>=2024.2,<2025.0  # Updated for latest timezone data
 
 # HTTP requests
 requests>=2.33.0,<3.0.0
+urllib3>=1.26.0,<3.0.0  # requests transitive, but imported directly (urllib3.util.retry.Retry)
 
 # Google API integration
 
 # Font rendering
 freetype-py>=2.5.1,<3.0.0
 
-# Spotify integration
+# Spotify integration (used by web_interface/blueprints/api_v3.py OAuth endpoints)
 spotipy>=2.25.2,<3.0.0
 
 # Flask web framework
 Flask>=3.1.3,<4.0.0
 
-# Text processing
+# WebSocket support: intentionally NOT declared here. Plugins that need
-
+# it (e.g. ledmatrix-music's Socket.IO client) declare it in their own
-# Calendar integration
+# requirements.txt, which the plugin store installs.
-
-# WebSocket support
-python-socketio>=5.14.0,<6.0.0
-python-engineio>=4.9.0,<5.0.0
-websockets>=12.0,<14.0
-websocket-client>=1.8.0,<2.0.0
 
 # JSON Schema validation
 jsonschema>=4.20.0,<5.0.0
@@ -43,7 +38,6 @@ packaging>=23.0,<27.0
 pytest>=9.0.3,<10.0.0
 pytest-cov>=4.1.0,<5.0.0
 pytest-mock>=3.11.0,<4.0.0
-mypy>=1.5.0,<2.0.0
 
 # ───────────────────────────────────────────────────────────────────────
 # Optional dependencies — the code imports these inside try/except

scripts/install_dependencies_apt.py

@@ -49,12 +49,7 @@ def install_via_apt(package_name: str) -> Tuple[bool, str]:
         'werkzeug': 'python3-werkzeug',
         'numpy': 'python3-numpy',
         'requests': 'python3-requests',
-        'python-dateutil': 'python3-dateutil',
+        'pytz': 'python3-tz'
-        'pytz': 'python3-tz',
-        'geopy': 'python3-geopy',
-        'unidecode': 'python3-unidecode',
-        'websockets': 'python3-websockets',
-        'websocket-client': 'python3-websocket-client'
     }
 
     apt_package = apt_package_map.get(package_name, f'python3-{package_name}')
@@ -152,12 +147,7 @@ def main():
         'werkzeug',
         'numpy',
         'requests',
-        'python-dateutil',
+        'pytz'
-        'pytz',
-        'geopy',
-        'unidecode',
-        'websockets',
-        'websocket-client'
     ]
 
     failed_packages = []
@@ -177,15 +167,12 @@ def main():
                 failure_details[package] = pip_output or apt_output
 
     # Install packages that don't have apt equivalents
+    # Packages without apt equivalents. Plugin-specific dependencies
+    # (timezonefinder, google-api stack, icalevents, socketio, ...) are
+    # no longer installed here — store plugins declare their own
+    # requirements.txt, which the plugin store installs.
     special_packages = [
-        'timezonefinder>=6.5.0,<7.0.0',
-        'google-auth-oauthlib>=1.2.0,<2.0.0',
-        'google-auth-httplib2>=0.2.0,<1.0.0',
-        'google-api-python-client>=2.147.0,<3.0.0',
         'spotipy',
-        'icalevents',
-        'python-socketio>=5.11.0,<6.0.0',
-        'python-engineio>=4.9.0,<5.0.0'
     ]
 
     for package in special_packages:

web_interface/requirements.txt

@@ -4,20 +4,15 @@
 
 # Web framework
 flask>=3.1.3,<4.0.0
-werkzeug>=3.1.6,<4.0.0
-flask-wtf>=1.2.0  # CSRF protection (optional for local-only, but recommended)
 flask-limiter>=3.5.0,<4.0.0  # Rate limiting (prevent accidental abuse)
 flask-compress>=1.14  # gzip/brotli response compression (big win for the large JS/HTML over WiFi)
+jinja2>=3.1.0,<4.0.0  # Flask transitive, but imported directly (TemplateNotFound)
+markupsafe>=2.1.0,<4.0.0  # Flask transitive, but imported directly (escape)
 
-# WebSocket support for plugins
+# WebSocket support: intentionally NOT declared here. The web interface
-# Note: Web interface uses Server-Sent Events (SSE) for real-time updates, not WebSockets
+# uses Server-Sent Events, and plugins that need Socket.IO (e.g.
-# However, plugins may need websocket support to connect to external services
+# ledmatrix-music) declare it in their own requirements.txt, which the
-# (e.g., music plugin connecting to YTM Companion server via Socket.IO)
+# plugin store installs.
-# These packages are required for plugin compatibility
-python-socketio>=5.14.0,<6.0.0
-python-engineio>=4.9.0,<5.0.0
-websockets>=12.0,<14.0
-websocket-client>=1.8.0,<2.0.0
 
 # Image processing
 Pillow>=12.2.0,<13.0.0
@@ -35,24 +30,13 @@ numpy>=1.24.0
 # HTTP requests
 requests>=2.33.0,<3.0.0
 
-# Date/time utilities
-python-dateutil>=2.9.0,<3.0.0
-
 # Timezone handling (must match main requirements)
 pytz>=2024.2,<2025.0
-timezonefinder>=6.5.0,<7.0.0
-geopy>=2.4.1,<3.0.0
-
-# Google API integration (must match main requirements)
-google-auth-oauthlib>=1.2.0,<2.0.0
-google-auth-httplib2>=0.2.0,<1.0.0
-google-api-python-client>=2.147.0,<3.0.0
 
 # Spotify integration (must match main requirements)
 spotipy>=2.25.2,<3.0.0
 
-# Text processing (must match main requirements)
+# Plugin-era note: timezonefinder, geopy, the google-api client stack,
-unidecode>=1.3.8,<2.0.0
+# unidecode, icalevents and python-dateutil used to live here for the
-
+# built-in weather/calendar/music displays. Those are store plugins now
-# Calendar integration (must match main requirements)
+# and declare their own dependencies, which the plugin store installs.
-icalevents>=0.1.27,<1.0.0