From 2d19ab49a9cd0d3c3aa705372c15872c67b2701f Mon Sep 17 00:00:00 2001 From: Vaibhav Gulati Date: Thu, 22 Oct 2026 15:30:15 +0000 Subject: [PATCH] fix: upgrade certifi to 2026.10.19 and pip to 26.2.2 (eMudhra CA removal) The emSign root CA is removed from certifi 2026.10.19 after the eMudhra security incident (GHSA-6q48-6c7w-9gw2). pip vendors its own certifi, so pip must be upgraded to 26.2.2 as well. pip-tools is bumped to 7.6.2, the first release that works with pip 26.2.x. Ticket: LP-1401 Co-Authored-By: Claude Opus 5.5 --- requirements.txt | 2 +- requirements/common_constraints.txt | 2 +- requirements/dev.txt | 4 ++-- requirements/pip-tools.txt | 2 +- requirements/pip.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/requirements.txt b/requirements.txt index e2d47890..9ca55e64 100644 --- a/requirements.txt +++ b/requirements.txt @@ -14,7 +14,7 @@ botocore==1.43.106 # via # boto3 # s3transfer -certifi==2026.7.22 +certifi==2026.10.19 # via requests cffi==2.1.1 # via pynacl diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt index 50d07f65..67a45d4c 100644 --- a/requirements/common_constraints.txt +++ b/requirements/common_constraints.txt @@ -45,4 +45,4 @@ social-auth-core<5.0.0 # Exceptional conditions for removal: # - We stop using pip-tools, OR # - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257 -pip<26.2.1 # Known to work with pip-tools==7.6.1 +pip<=26.2.2 # Known to work with pip-tools==7.6.2 diff --git a/requirements/dev.txt b/requirements/dev.txt index e7a212c7..7ce197a0 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -25,7 +25,7 @@ cachetools==7.2.0 # via # -r requirements/ci.txt # tox -certifi==2026.7.22 +certifi==2026.10.19 # via # -r requirements/test.txt # requests @@ -122,7 +122,7 @@ packaging==26.3 # wheel path==17.1.1 # via -r requirements/test.txt -pip-tools==7.6.1 +pip-tools==7.6.2 # via -r requirements/pip-tools.txt platformdirs==4.12.2 # via diff --git a/requirements/pip-tools.txt b/requirements/pip-tools.txt index df8bedd6..4fb32ea1 100644 --- a/requirements/pip-tools.txt +++ b/requirements/pip-tools.txt @@ -12,7 +12,7 @@ packaging==26.3 # via # build # wheel -pip-tools==7.6.1 +pip-tools==7.6.2 # via -r requirements/pip-tools.in pyproject-hooks==1.3.3 # via diff --git a/requirements/pip.txt b/requirements/pip.txt index 582d6205..b7d5d37f 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -10,7 +10,7 @@ wheel==0.48.0 # via -r requirements/pip.in # The following packages are considered to be unsafe in a requirements file: -pip==26.2 +pip==26.2.2 # via # -c requirements/common_constraints.txt # -r requirements/pip.in diff --git a/requirements/test.txt b/requirements/test.txt index fb33ce81..3cd806a1 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -17,7 +17,7 @@ botocore==1.43.106 # -r requirements.txt # boto3 # s3transfer -certifi==2026.7.22 +certifi==2026.10.19 # via # -r requirements.txt # requests