[vgulati-apphelix]

Description

Security fix for the eMudhra / emSign CA incident (GHSA-6q48-6c7w-9gw2). certifi 2026.10.19 removes the compromised emSign root; pip ships its own certifi, so it needs 26.2.2 too.

• certifi → 2026.10.19
• pip → 26.2.2 (pip cap, where present locally, → pip<=26.2.2, matching openedx/edx-lint#578)
• pip-tools → 7.6.2 (older versions crash with pip 26.2.x)

After merge, rebuild and redeploy the image. Note: the xqueue.Dockerfile in edx/public-dockerfiles creates its venv with python -m venv and never upgrades pip, so the image's pip stays old until that Dockerfile is updated (separate change). certifi in the image comes from requirements.txt and will be 2026.10.19.

Supporting information

• Jira: LP-1401 (private)
• Upstream tracking: openedx/public-engineering#574

Testing

• Fresh venv: pip.txt → pip-tools → dev/test requirements installs cleanly, pip check clean (pip 26.2.2, pip-tools 7.6.2, certifi 2026.10.19)
• Root requirements.txt (production) installs with certifi 2026.10.19
• pytest submission_queue against a throwaway MySQL 8.0: 41 passed, 4 skipped

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The dependency pins and compatibility constraint are consistent across all six changed files, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Updates the application’s certificate bundle and Python packaging tools to address the eMudhra/emSign CA incident while maintaining pip-tools compatibility.

Changes:

• Upgrades certifi to 2026.10.19 across production, test, and development requirements.
• Upgrades pip to 26.2.2 and pip-tools to 7.6.2.
• Adjusts the shared pip cap to <=26.2.2.

Image rebuild and redeployment remain necessary; upgrading the image’s bundled pip requires the separate Dockerfile change noted in the description.

File	Description
requirements/​test.txt	Updates the test certificate bundle.
requirements/​pip.txt	Pins pip to the patched version.
requirements/​pip-tools.txt	Pins the compatible pip-tools version.
requirements/​dev.txt	Aligns certifi and pip-tools development pins.
requirements/​common_constraints.txt	Updates the pip compatibility cap and comment.
requirements.txt	Updates the production certificate bundle.

_{Review effort: Balanced}