fix: upgrade certifi to 2026.10.19 and pip to 26.2.2 (eMudhra CA removal) (#530)

The emSign root CA is removed from certifi 2026.10.19 after the eMudhra
security incident (GHSA-6q48-6c7w-9gw2). pip vendors its own certifi, so
pip must be upgraded to 26.2.2 as well. pip-tools is bumped to 7.6.2,
the first release that works with pip 26.2.x.

Ticket: LP-1401

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: vgulati-apphelix

requirements/common_constraints.txt

@@ -44,4 +44,4 @@ social-auth-core<5.0.0
 # Exceptional conditions for removal:
 # - We stop using pip-tools, OR
 # - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257
-pip<26.2.1  # Known to work with pip-tools==7.6.1
+pip<=26.2.2  # Known to work with pip-tools==7.6.2

requirements/edx/base.txt

@@ -102,7 +102,7 @@ celery==5.5.3
     #   enterprise-integrated-channels
     #   event-tracking
     #   openedx-learning
-certifi==2025.10.5
+certifi==2026.10.19
     # via
     #   elasticsearch
     #   httpcore

requirements/edx/development.txt

@@ -188,7 +188,7 @@ celery==5.5.3
     #   enterprise-integrated-channels
     #   event-tracking
     #   openedx-learning
-certifi==2025.10.5
+certifi==2026.10.19
     # via
     #   -r requirements/edx/doc.txt
     #   -r requirements/edx/testing.txt
@@ -1463,7 +1463,7 @@ pillow==11.3.0
     #   edx-enterprise
     #   edx-organizations
     #   edxval
-pip-tools==7.5.1
+pip-tools==7.6.2
     # via -r requirements/pip-tools.txt
 platformdirs==4.4.0
     # via

requirements/edx/doc.txt

@@ -142,7 +142,7 @@ celery==5.5.3
     #   enterprise-integrated-channels
     #   event-tracking
     #   openedx-learning
-certifi==2025.10.5
+certifi==2026.10.19
     # via
     #   -r requirements/edx/base.txt
     #   elasticsearch

requirements/edx/semgrep.txt

@@ -25,7 +25,7 @@ boltons==21.0.0
     #   semgrep
 bracex==2.6
     # via wcmatch
-certifi==2025.10.5
+certifi==2026.10.19
     # via
     #   httpcore
     #   httpx

requirements/edx/testing.txt

@@ -140,7 +140,7 @@ celery==5.5.3
     #   enterprise-integrated-channels
     #   event-tracking
     #   openedx-learning
-certifi==2025.10.5
+certifi==2026.10.19
     # via
     #   -r requirements/edx/base.txt
     #   elasticsearch

requirements/pip-tools.txt

@@ -10,7 +10,7 @@ click==8.3.0
     # via pip-tools
 packaging==25.0
     # via build
-pip-tools==7.5.1
+pip-tools==7.6.2
     # via -r requirements/pip-tools.in
 pyproject-hooks==1.2.0
     # via

requirements/pip.txt

@@ -8,7 +8,7 @@ wheel==0.45.1
     # via -r requirements/pip.in
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==25.2
+pip==26.2.2
     # via
     #   -c requirements/common_constraints.txt
     #   -r requirements/pip.in

scripts/user_retirement/requirements/base.txt

@@ -18,7 +18,7 @@ botocore==1.40.46
     #   s3transfer
 cachetools==6.2.0
     # via google-auth
-certifi==2025.10.5
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via

scripts/user_retirement/requirements/testing.txt

@@ -28,7 +28,7 @@ cachetools==6.2.0
     # via
     #   -r scripts/user_retirement/requirements/base.txt
     #   google-auth
-certifi==2025.10.5
+certifi==2026.10.19
     # via
     #   -r scripts/user_retirement/requirements/base.txt
     #   requests