From 3fa4a4cf3daa92930b87b2f733503a144c396ecd Mon Sep 17 00:00:00 2001 From: Vaibhav Gulati Date: Thu, 22 Oct 2026 15:30:10 +0000 Subject: [PATCH] fix: upgrade certifi to 2026.10.19 and pip to 26.2.2 (eMudhra CA removal) The emSign root CA is removed from certifi 2026.10.19 after the eMudhra security incident (GHSA-6q48-6c7w-9gw2). pip vendors its own certifi, so pip must be upgraded to 26.2.2 as well. pip-tools is bumped to 7.6.2, the first release that works with pip 26.2.x. Ticket: LP-1401 Co-Authored-By: Claude Opus 5.5 --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc.txt | 2 +- requirements/pip-tools.txt | 2 +- requirements/pip.txt | 3 ++- 5 files changed, 6 insertions(+), 5 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 090ddc11..76ddaf07 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -15,4 +15,4 @@ # Make upgrade command and all requirements upgrade jobs are broken due to this. # See issue https://github.com/edx/devstack/issues/195 for details regarding the ongoing fix. # The constraint can be removed once a release (pip-tools > 7.5.1) is available with support for pip 25.3 -pip<25.3 +pip<=26.2.2 # Known to work with pip-tools==7.6.2 diff --git a/requirements/dev.txt b/requirements/dev.txt index 23c9b521..3cde051c 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -38,7 +38,7 @@ packaging==25.0 # tox pexpect==4.9.0 # via -r requirements/test.txt -pip-tools==7.5.1 +pip-tools==7.6.2 # via -r requirements/pip-tools.txt platformdirs==4.5.0 # via diff --git a/requirements/doc.txt b/requirements/doc.txt index d6ffa26a..58a34a9b 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -14,7 +14,7 @@ babel==2.17.0 # sphinx beautifulsoup4==4.14.2 # via pydata-sphinx-theme -certifi==2025.10.5 +certifi==2026.10.19 # via requests charset-normalizer==3.4.4 # via requests diff --git a/requirements/pip-tools.txt b/requirements/pip-tools.txt index e97cb1b3..173c2952 100644 --- a/requirements/pip-tools.txt +++ b/requirements/pip-tools.txt @@ -10,7 +10,7 @@ click==8.3.0 # via pip-tools packaging==25.0 # via build -pip-tools==7.5.1 +pip-tools==7.6.2 # via -r requirements/pip-tools.in pyproject-hooks==1.2.0 # via diff --git a/requirements/pip.txt b/requirements/pip.txt index 172b7cce..7e9a1fad 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -8,9 +8,10 @@ wheel==0.45.1 # via -r requirements/pip.in # The following packages are considered to be unsafe in a requirements file: -pip==25.2 +pip==26.2.2 # via # -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt + # -c requirements/constraints.txt # -r requirements/pip.in setuptools==80.9.0 # via -r requirements/pip.in