Bump the all-pip-updates group across 3 directories with 29 updates

requirements/base.txt

@@ -3,7 +3,7 @@
 
 aiohttp>=3.13.5,<3.14.0; python_version < '3.10'
 aiohttp>=3.14.1; python_version >= '3.10'
-certifi>=2026.5.20
+certifi>=2026.6.17
 cffi>=2.0.0
 # cheroot 8.5.2 fails to build with modern setuptools due to setuptools_scm_git_archive dependency
 cheroot>=11.1.2
@@ -17,15 +17,18 @@ croniter!=0.3.22,>=6.2.2; sys_platform != 'win32'
 # last 46.x release for Python 3.9 so uv pip compile can still resolve.
 # Furthermore, pyOpenSSL 26.2 dropped X509Extension and add_extensions()
 # which breaks salt/modules/tls.py. pyOpenSSL < 26.2 requires cryptography < 48.0.0.
-cryptography>=46.0.7,<48.0.0
+cryptography>=46.0.7,<48.0.0; python_version < '3.10'
+cryptography>=49.0.0,<50.0.0; python_version >= '3.10'
 distro>=1.9.0
 frozenlist>=1.8.0; python_version < '3.11'
 frozenlist>=1.5.0; python_version >= '3.11'
 gitpython>=3.1.50
 immutables>=0.21
 importlib-metadata>=8.7.0
-jaraco.functools>=4.4.0
-jaraco.context>=6.1.1
+jaraco.functools>=4.4.0,<4.5.0; python_version < '3.10'
+jaraco.functools>=4.5.0; python_version >= '3.10'
+jaraco.context>=6.1.1,<6.1.2; python_version < '3.10'
+jaraco.context>=6.1.2; python_version >= '3.10'
 jaraco.text>=4.2.0
 Jinja2>=3.1.6
 jmespath>=1.1.0
@@ -35,56 +38,63 @@ MarkupSafe<4.0.0
 # multidict 6.0.4 fails to source-build under clang 17+ with strict int/pointer
 # conversion checks (macOS 15 onedir builds compile from sdist via
 # --no-binary=:all:). 6.6+ fixed the C source compatibility.
-multidict>=6.6.0
-msgpack>=1.1.2
+multidict>=6.7.1
+msgpack>=1.1.2,<1.2.0; python_version < '3.10'
+msgpack>=1.2.1; python_version >= '3.10'
 # Packaging 24.1+ imports annotations from __future__ which breaks
 # salt-ssh on target hosts with older Python versions (Amazon Linux 2
 # still ships Python 3.7). 26.x additionally uses positional-only
 # `/` parameter syntax which is a SyntaxError on Python <3.8. Keep at
 # 24.0 to preserve salt-ssh compatibility against legacy target
 # Pythons; salt 3006.x still promises this matrix.
-packaging==24.0
+packaging==26.2
 psutil<6.0.0; python_version <= '3.9'
-psutil>=5.0.0; python_version >= '3.10'
+psutil>=7.2.2; python_version >= '3.10'
 # pymssql 2.3.12+ dropped win32 (32-bit Windows) wheels; salt 3006.x
 # still builds a Windows x86 onedir, so pin to the last release that
 # ships cp3X-win32 wheels.
-pymssql==2.3.11; sys_platform == 'win32'
+pymssql==2.3.13; sys_platform == 'win32'
 pymysql>=1.2.0; sys_platform == 'win32'
-pyopenssl>=26.0.0,<26.2.0
+pyopenssl>=26.0.0,<26.2.0; python_version < '3.10'
+pyopenssl>=26.3.0,<26.4.0; python_version >= '3.10'
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
-pythonnet>=3.0.5; sys_platform == 'win32'
+pythonnet>=3.0.5,<3.1.0; sys_platform == 'win32' and python_version < '3.10'
+pythonnet>=3.1.0; sys_platform == 'win32' and python_version >= '3.10'
 tzdata; sys_platform == 'win32'
 pywin32>=312; sys_platform == 'win32'
 pycryptodomex>=3.23.0
 PyYAML>=6.0.3
 requests>=2.32.5 ; python_version < '3.10'
-requests>=2.33.1 ; python_version >= '3.10'
+requests>=2.34.2 ; python_version >= '3.10'
 rpm-vercmp; sys_platform == 'linux'
 setproctitle>=1.3.7
 # pyzmq 27 dropped its tornado runtime dep; pyzmq.eventloop submodules
 # (zmqstream, future) still import tornado.ioloop at module load. Pin
 # tornado explicitly so onedir lockfiles keep shipping it.
-tornado>=6.5.5
+tornado>=6.5.7
 # Python 3.9 stays on urllib3 1.26.x because botocore on py3.9 hard
 # requires urllib3 < 2 and Salt 3006.x still builds a py3.9 onedir.
 # The Python 3.10+ floor carries the urllib3 2.6.3 CVE backports
 # (CVE-2025-66418, CVE-2026-21441).
 urllib3>=1.26.20,<2.0.0; python_version < '3.10'
 urllib3>=2.7.0; python_version >= '3.10'
-virtualenv>=21.4.2
+virtualenv>=21.4.2,<21.5.0; python_version < '3.10'
+virtualenv>=21.5.1; python_version >= '3.10'
 # Transitive of virtualenv; some uv resolver caches pin a stale 3.25
 # version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
-filelock>=3.29.1; python_version >= '3.10'
+filelock>=3.29.4; python_version >= '3.10'
 filelock>=3.19.1,<3.29.0; python_version < '3.10'
 wmi>=1.5.1; sys_platform == 'win32'
 xmltodict>=1.0.4; sys_platform == 'win32'
-zipp>=3.23.1
+zipp>=3.23.1,<4.0.0; python_version < '3.10'
+zipp>=4.1.0; python_version >= '3.10'
 apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
 apache-libcloud>=3.9.1; python_version >= '3.10'
 idna>=3.18
-more-itertools>=10.8.0
+more-itertools>=10.8.0,<11.0.0; python_version < '3.10'
+more-itertools>=11.1.0; python_version >= '3.10'
 pyasn1>=0.6.3
-pycparser>=2.23
+pycparser>=2.23; python_version < '3.10'
+pycparser>=3.0; python_version >= '3.10'
 vultr>=1.0.1

requirements/build.txt

@@ -1,2 +1,2 @@
 twine
-build>=1.4.4
+build>=1.5.0

requirements/constraints.txt

@@ -11,7 +11,7 @@ wheel >= 0.47.0
 # setuptools; this floor only relaxes what the onedir-bundled pip is
 # allowed to use.
 setuptools >= 78.1.1
-pip == 26.0.1
+pip == 26.1.2
 markdown-it-py < 3.0.0; python_version == "3.9"
 # myst-docutils 4.x (the latest supporting Python 3.10) requires
 # markdown-it-py ~=3.0; the 5.x line that pairs with markdown-it-py 4.x

requirements/pytest.txt

@@ -2,7 +2,8 @@ mock >= 5.2.0
 # PyTest
 docker >= 7.1.0; python_version >= '3.8'
 docker < 7.1.0; python_version < '3.8'
-pytest >= 8.4.2
+pytest >= 8.4.2, < 9.0.0 ; python_version < '3.10'
+pytest >= 9.1.1 ; python_version >= '3.10'
 pytest-salt-factories >= 1.0.5
 pytest-helpers-namespace >= 2021.12.29
 pytest-subtests

requirements/static/ci/common.txt

@@ -14,16 +14,17 @@ bcrypt
 # our urllib3 floor is 2.6.3 so we skip the boto3 cloud module tests on
 # 3.9 by not pinning it here. The bare `boto3` package is still
 # available transitively for any tool that needs it.
-boto3>=1.43.24; python_version >= '3.10'
+boto3>=1.43.36; python_version >= '3.10'
 boto>=2.49.0
-cryptography>=46.0.7,<48.0.0
+cryptography>=46.0.7,<48.0.0; python_version < '3.10'
+cryptography>=49.0.0,<50.0.0; python_version >= '3.10'
 cffi>=2.0.0
 cherrypy>=18.10.0
 clustershell
 dnspython
 etcd3-py==0.1.6
 filelock>=3.19.1 ; python_version < '3.10'
-filelock>=3.29.1 ; python_version >= '3.10'
+filelock>=3.29.4 ; python_version >= '3.10'
 gitpython>=3.1.50
 google-auth==2.35.0; python_version == '3.9'
 jmespath>=1.1.0
@@ -47,7 +48,7 @@ napalm; sys_platform != 'win32' and python_version < '3.10'
 paramiko>=5.0.0; sys_platform != 'win32' and sys_platform != 'darwin'
 passlib>=1.7.4
 pycryptodomex
-pynacl>=1.5.0
+pynacl>=1.6.2
 pyinotify>=0.9.6; sys_platform != 'win32' and sys_platform != 'darwin' and platform_system != "openbsd"
 python-etcd>=0.4.5
 pyvmomi
@@ -59,12 +60,14 @@ toml
 # vcert 0.18.x adds hard pins on cryptography, pynacl, and six that
 # conflict with every other CI requirement; stay on 0.9.x.
 vcert~=0.9.0; sys_platform != 'win32'
-virtualenv>=21.4.2
+virtualenv>=21.4.2,<21.5.0; python_version < '3.10'
+virtualenv>=21.5.1; python_version >= '3.10'
 watchdog>=6.0.0
 websocket-client>=1.9.0
 # werkzeug is a dependency of moto
 werkzeug>=3.1.8
-xmldiff>=2.7.0
+xmldiff>=2.7.0,<3.0; python_version < '3.10'
+xmldiff>=3.0; python_version >= '3.10'
 # Available template libraries that can be used
 genshi>=0.7.11
 cheetah3>=3.2.6.post1

requirements/static/ci/darwin.txt

@@ -1,5 +1,5 @@
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 yamllint
 mercurial>=7.2.2
 hglib

requirements/static/ci/linux.txt

@@ -1,18 +1,18 @@
 # Linux static CI requirements
 pyiface
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 pymysql>=1.2.0
 # ansible release lines support different Python versions:
 #   ansible-core / ansible 10.x — Python 3.10+
 #   ansible 12.x — Python 3.11+
 #   ansible 14.x — Python 3.12+
 ansible>=10.7.0,<11.0.0; python_version >= '3.10' and python_version < '3.11'
 ansible>=12.3.0,<13.0.0; python_version >= '3.11' and python_version < '3.12'
-ansible>=14.0.0; python_version >= '3.12'
+ansible>=14.1.0; python_version >= '3.12'
 twilio>=9.10.9
 python-telegram-bot>=20.3,<22.0; python_version < '3.10'
-python-telegram-bot>=22.7; python_version >= '3.10'
+python-telegram-bot>=22.8; python_version >= '3.10'
 yamllint
 mercurial>=7.2.2
 hglib

requirements/static/ci/py3.10/changelog.lock

@@ -14,7 +14,7 @@ markupsafe==2.1.5
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   jinja2
-packaging==24.0
+packaging==26.2
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/changelog.txt

requirements/static/ci/py3.10/cloud.lock

@@ -65,18 +65,18 @@ boto==2.49.0
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/common.txt
-boto3==1.43.25
+boto3==1.43.38
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/common.txt
     #   moto
-botocore==1.43.25
+botocore==1.43.38
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.5.20
+certifi==2026.6.17
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -132,7 +132,7 @@ croniter==6.2.2
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
     #   -r requirements/base.txt
-cryptography==47.0.0
+cryptography==49.0.0
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -181,7 +181,7 @@ exceptiongroup==1.1.1
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   pytest
-filelock==3.29.1
+filelock==3.29.4
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -385,7 +385,7 @@ moto==5.2.2
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/common.txt
-msgpack==1.1.2
+msgpack==1.2.1
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -415,7 +415,7 @@ oscrypto==1.3.0
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   certvalidator
-packaging==24.0
+packaging==26.2
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -495,12 +495,12 @@ pyinotify==0.9.6
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/common.txt
-pynacl==1.5.0
+pynacl==1.6.2
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/common.txt
     #   paramiko
-pyopenssl==26.1.0
+pyopenssl==26.3.0
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -526,7 +526,7 @@ pyspnego==0.9.0
     #   -r requirements/static/ci/cloud.txt
     #   requests-ntlm
     #   smbprotocol
-pytest==9.0.3
+pytest==9.1.1
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/pytest.txt
@@ -590,7 +590,7 @@ python-dateutil==2.9.0.post0
     #   croniter
     #   kubernetes
     #   vcert
-python-discovery==1.4.0
+python-discovery==1.4.2
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -633,7 +633,7 @@ pyzmq==27.1.0
     #   -c requirements/static/pkg/py3.10/linux.lock
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
-requests==2.33.1
+requests==2.34.2
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -675,7 +675,7 @@ rpm-vercmp==0.1.2
     #   -c requirements/static/pkg/py3.10/linux.lock
     #   -r requirements/base.txt
     #   -r requirements/static/pkg/linux.txt
-s3transfer==0.18.0
+s3transfer==0.19.0
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   boto3
@@ -811,7 +811,7 @@ vcert==0.9.1
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/common.txt
-virtualenv==21.4.2
+virtualenv==21.5.1
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
@@ -842,7 +842,7 @@ werkzeug==3.1.8
     #   -r requirements/static/ci/common.txt
     #   moto
     #   pytest-httpserver
-xmldiff==2.7.0
+xmldiff==3.0
     # via
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -r requirements/static/ci/common.txt