Bump the all-pip-updates group across 3 directories with 55 updates

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: cffi
  dependency-version: 2.1.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: croniter
  dependency-version: 6.2.4
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: gitpython
  dependency-version: 3.1.62
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: jaraco-functools
  dependency-version: 4.6.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: jaraco-context
  dependency-version: 6.1.2
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: jaraco-text
  dependency-version: 4.3.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: lxml
  dependency-version: 6.1.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: msgpack
  dependency-version: 1.2.2
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: multidict
  dependency-version: 6.8.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: opentelemetry-api
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: opentelemetry-sdk
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: opentelemetry-exporter-prometheus
  dependency-version: 0.65b0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: xxhash
  dependency-version: 4.0.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: psutil
  dependency-version: 7.2.2
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: tornado
  dependency-version: 6.5.10
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: truststore
  dependency-version: 0.10.4
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: virtualenv
  dependency-version: 21.7.10
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: filelock
  dependency-version: 3.32.7
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: zipp
  dependency-version: 4.1.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: wheel
  dependency-version: 0.48.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: setuptools-scm
  dependency-version: 10.2.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pip
  dependency-version: 26.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-pip-updates
- dependency-name: cython
  dependency-version: 3.3.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: docker
  dependency-version: 7.2.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: build
  dependency-version: 1.6.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pyzmq
  dependency-version: 27.2.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: cffi
  dependency-version: 2.1.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: gitpython
  dependency-version: 3.1.62
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-pip-updates
- dependency-name: virtualenv
  dependency-version: 21.7.10
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: filelock
  dependency-version: 3.32.7
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: docker
  dependency-version: 7.2.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: towncrier
  dependency-version: 26.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-pip-updates
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-pip-updates
- dependency-name: m2crypto
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-pip-updates
- dependency-name: pylint
  dependency-version: 3.3.9
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: boto3
  dependency-version: 1.43.96
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: botocore
  dependency-version: 1.43.96
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: kubernetes
  dependency-version: 36.0.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: moto
  dependency-version: 5.2.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pynacl
  dependency-version: 1.6.2
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: sqlparse
  dependency-version: 0.6.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: vcert
  dependency-version: 0.9.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: xmldiff
  dependency-version: '3.0'
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: mercurial
  dependency-version: 7.2.4
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pygit2
  dependency-version: 1.20.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: ansible
  dependency-version: 14.4.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: twilio
  dependency-version: 9.11.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: python-telegram-bot
  dependency-version: '22.8'
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: importlib-metadata
  dependency-version: 9.0.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pyopenssl
  dependency-version: 26.4.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

requirements/base.txt

@@ -2,32 +2,32 @@
 # Multiple entries for the same package (with different version constraints) are grouped together.
 
 aiohttp>=3.13.5,<3.14.0; python_version < '3.10'
-aiohttp>=3.14.1; python_version >= '3.10'
+aiohttp>=3.14.3; python_version >= '3.10'
 apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
 apache-libcloud>=3.9.1; python_version >= '3.10'
 # attrs and charset-normalizer are pulled in transitively by aiohttp/requests.
 # Explicit floors on py>=3.10 keep them at the current CVE-patched line.
 attrs>=26.1.0; python_version >= '3.10'
-certifi>=2026.5.20
-cffi>=2.0.0
-charset-normalizer>=3.4.7; python_version >= '3.10'
+certifi>=2026.7.22
+cffi>=2.1.1
+charset-normalizer>=3.5.1; python_version >= '3.10'
 # cheroot 8.5.2 fails to build with modern setuptools due to setuptools_scm_git_archive dependency
 cheroot>=11.1.2
 cherrypy>=18.10.0
 # We need contextvars for salt-ssh
 contextvars; python_version < '3.7'
-croniter!=0.3.22,>=6.2.2; sys_platform != 'win32'
+croniter!=0.3.22,>=6.2.4; sys_platform != 'win32'
 # cryptography 48.0.0 drops support for Python 3.9.0 and 3.9.1
 # (only >3.9.1 is accepted), but the py3.9 lock files are compiled
 # with --python-version=3.9 which includes those releases. Cap at the
 # last 46.x release for Python 3.9 so uv pip compile can still resolve.
 cryptography>=46.0.7,<48.0.0; python_version < '3.10'
-cryptography>=50.0.0; python_version >= '3.10'
+cryptography>=50.0.1; python_version >= '3.10'
 distro>=1.9.0
 frozenlist>=1.8.0; python_version < '3.11'
 frozenlist>=1.5.0; python_version >= '3.11'
-gitpython>=3.1.59
-idna>=3.18
+gitpython>=3.1.62
+idna>=3.19
 immutables>=0.21; python_version < '3.7'
 # importlib-metadata 9.x drops py3.9 support. Cap on py3.9, allow 8.7+ on
 # py3.10, and let py>=3.11 use the existing 8.7+ floor.
@@ -36,45 +36,45 @@ importlib-metadata>=8.7.0; python_version >= '3.10'
 # jaraco.functools 4.5.0 and jaraco.context 6.1.2 drop Python 3.9; keep the
 # last 3.9-compatible releases there and let py>=3.10 float forward.
 jaraco.functools>=4.4.0,<4.5.0; python_version < '3.10'
-jaraco.functools>=4.4.0; python_version >= '3.10'
+jaraco.functools>=4.6.0; python_version >= '3.10'
 jaraco.context>=6.1.1,<6.1.2; python_version < '3.10'
-jaraco.context>=6.1.1; python_version >= '3.10'
-jaraco.text>=4.2.0
+jaraco.context>=6.1.2; python_version >= '3.10'
+jaraco.text>=4.3.0
 Jinja2>=3.1.6
 jmespath>=1.1.0
 looseversion
-lxml>=6.1.1; sys_platform == 'win32'
+lxml>=6.1.3; sys_platform == 'win32'
 MarkupSafe>=3.0.3; python_version < '3.14'
 MarkupSafe>=3.0.3,<4.0.0; python_version >= '3.14'
 more-itertools>=10.8.0,<11.0.0; python_version < '3.10'
 more-itertools>=11.1.0; python_version >= '3.10'
 # msgpack 1.2.1 drops Python 3.9; keep the last 3.9-compatible release there.
 msgpack>=1.1.2,<1.2.1 ; python_version < '3.10'
-msgpack>=1.2.1 ; python_version >= '3.10'
+msgpack>=1.2.2 ; python_version >= '3.10'
 # multidict 6.0.4 fails to source-build under clang 17+ with strict int/pointer
 # conversion checks (macOS 15 onedir builds compile from sdist via
 # --no-binary=:all:). 6.6+ fixed the C source compatibility.
-multidict>=6.6.0
+multidict>=6.8.0
 # opentelemetry 1.43.0 (and exporter-prometheus 0.64b0) drop Python 3.9; keep
 # the last 3.9-compatible releases there and let py>=3.10 float forward.
 opentelemetry-api>=1.41.1,<1.43.0; python_version < '3.10'
-opentelemetry-api>=1.41.1; python_version >= '3.10'
+opentelemetry-api>=1.44.0; python_version >= '3.10'
 opentelemetry-sdk>=1.41.1,<1.43.0; python_version < '3.10'
-opentelemetry-sdk>=1.41.1; python_version >= '3.10'
+opentelemetry-sdk>=1.44.0; python_version >= '3.10'
 opentelemetry-exporter-otlp-proto-http>=1.41.1,<1.43.0; python_version < '3.10'
-opentelemetry-exporter-otlp-proto-http>=1.41.1; python_version >= '3.10'
+opentelemetry-exporter-otlp-proto-http>=1.44.0; python_version >= '3.10'
 opentelemetry-exporter-prometheus>=0.62b1,<0.64b0; python_version < '3.10'
-opentelemetry-exporter-prometheus>=0.62b1; python_version >= '3.10'
+opentelemetry-exporter-prometheus>=0.65b0; python_version >= '3.10'
 # xxhash 3.8.0 drops Python 3.9; keep the last 3.9-compatible release there.
 xxhash>=3.7.0,<3.8.0; python_version < '3.10'
-xxhash>=3.7.0; python_version >= '3.10'
+xxhash>=4.0.1; python_version >= '3.10'
 # Packaging 24.1 imports annotations from __future__ which breaks salt ssh
 # tests on target hosts with older python versions.
-packaging>=26.2; python_version < '3.11'
+packaging>=26.3; python_version < '3.11'
 packaging==24.0; python_version >= '3.11' and python_version < '3.14'
 packaging>=26.0,<27.0; python_version >= '3.14'
 psutil<6.0.0; python_version <= '3.9'
-psutil>=5.0.0; python_version >= '3.10'
+psutil>=7.2.2; python_version >= '3.10'
 pyasn1>=0.6.4
 pycparser>=2.23,<3.0; python_version < '3.10'
 pycparser>=3.0; python_version >= '3.10'
@@ -96,28 +96,28 @@ pywin32>=312; sys_platform == 'win32'
 pycryptodomex>=3.23.0
 PyYAML>=6.0.3
 requests>=2.32.5; python_version < '3.10'
-requests<2.32.0 ; python_version >= '3.10' and python_version < '3.11'
+requests<2.35.0 ; python_version >= '3.10' and python_version < '3.11'
 requests>=2.34.2 ; python_version >= '3.11'
 setproctitle>=1.3.7
 timelib>=0.3.0; python_version < '3.11'
 timelib>=0.3.0; python_version >= '3.11'
-tornado>=6.5.6
-truststore>=0.10.0; python_version >= "3.10"
+tornado>=6.5.10
+truststore>=0.10.4; python_version >= "3.10"
 # Python 3.9 stays on urllib3 1.26.x because botocore on py3.9 hard
 # requires urllib3 < 2 and Salt 3008.x still ships py3.9 lockfiles.
 # The Python 3.10+ floor carries the urllib3 2.6.3 CVE backports
 # (CVE-2025-66418, CVE-2026-21441).
 urllib3>=1.26.20,<2.0.0; python_version < '3.10'
-urllib3>=2.7.0; python_version >= '3.10'
+urllib3>=2.8.0; python_version >= '3.10'
 # virtualenv 21.5.1 drops Python 3.9; keep the last 3.9-compatible release there.
 virtualenv>=21.4.2,<21.5.1; python_version < '3.10'
-virtualenv>=21.4.2; python_version >= '3.10'
+virtualenv>=21.7.10; python_version >= '3.10'
 # Transitive of virtualenv; some uv resolver caches pin a stale 3.25
 # version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
-filelock>=3.29.1; python_version >= '3.10'
+filelock>=3.32.7; python_version >= '3.10'
 filelock>=3.19.1,<3.29.0; python_version < '3.10'
 wmi>=1.5.1; sys_platform == 'win32'
 xmltodict>=1.0.4; sys_platform == 'win32'
 # zipp 4.1.0 drops Python 3.9; keep the last 3.9-compatible release there.
 zipp>=3.23.1,<4.1.0; python_version < '3.10'
-zipp>=3.23.1; python_version >= '3.10'
+zipp>=4.1.0; python_version >= '3.10'

requirements/build.txt

@@ -1,2 +1,2 @@
 twine
-build>=1.4.4
+build>=1.6.1

requirements/constraints.txt

@@ -1,22 +1,22 @@
 # IMPORTANT: The versions here must be compatible with the environment where
 # uv-pre-commit hooks run. We do not pin setuptools in .pre-commit-config.yaml
 # to allow uv to resolve a version that satisfies these constraints.
-wheel >= 0.47.0
+wheel >= 0.48.0
 # Floor at the CVE fix: 78.1.1 patches GHSA-5rjg-fvgr-3xxf
 # (PYSEC-2025-49) -- path traversal in setuptools.PackageIndex.download.
 # Bumped to 82.0.1 to match the SRP baseline (PR #70130 on 3006.x); the
 # earlier yarl / PEP 517 build-env conflict is no longer reproducible with
 # our current pip and yarl versions -- 3007.x's lock resolves cleanly to
 # setuptools 84.x with the same >=78.1.1 floor.
 setuptools >= 82.0.1
-# Cap setuptools-scm < 10 in PEP 517 build envs. 10.1.1 (2026-06-22) split
+# Cap setuptools-scm < 11 in PEP 517 build envs. 10.1.1 (2026-06-22) split
 # version inference out into the ``vcs-versioning`` package; that path raises
 # ``LookupError: setuptools-scm was unable to detect version`` for source
 # tarballs that ship a ``PKG-INFO`` but no ``.git`` (e.g. cheroot 11.1.2 on
 # PyPI), breaking ``--no-binary=:all:`` onedir builds. PIP_CONSTRAINT
 # propagates to PEP 517 build envs since pip 22.1, so capping here keeps
 # build envs on the pre-split 9.x series for every source build.
-setuptools-scm < 10
+setuptools-scm < 11
 # This pin is for the dev/lint tooling venvs only -- tools/pkg/build.py
 # pins the packaged/shipped pip independently (currently 26.2) and is
 # unaffected by this value. Bumping past 25.2 here causes the noxfile
@@ -25,7 +25,7 @@ setuptools-scm < 10
 # which leaves the venv in a corrupted state because pip 26.0.1's
 # vendored pygments wheel is missing the modeline submodule on cpython
 # 3.14. Stay on 25.2.
-pip == 25.2
+pip == 26.2.1
 markdown-it-py < 3.0.0; python_version == "3.9"
 # myst-docutils 4.x (the latest supporting Python 3.10) requires
 # markdown-it-py ~=3.0; the 5.x line that pairs with markdown-it-py 4.x
@@ -51,4 +51,4 @@ junos-eznc < 2.7; python_version == "3.11"
 # ``--no-binary=:all:``). PIP_CONSTRAINT propagates into pyzmq's PEP 517 build
 # env, so capping Cython here keeps the pyzmq wheel compiling until pyzmq
 # ships a Cython 3.3-compatible release.
-Cython < 3.3
+Cython < 3.4

requirements/pytest.txt

@@ -1,8 +1,8 @@
 mock >= 5.2.0
 # PyTest
-docker >= 7.1.0; python_version >= '3.8'
+docker >= 7.2.0; python_version >= '3.8'
 docker < 7.1.0; python_version < '3.8'
-pytest >= 8.4.2, <9
+pytest >= 9.1.1, < 10
 pytest-salt-factories >= 1.0.5
 pytest-helpers-namespace >= 2021.12.29
 pytest-subtests

requirements/static/ci/changelog.txt

@@ -1,3 +1,3 @@
-towncrier==25.8.0
+towncrier==26.9.0
 looseversion
 packaging

requirements/static/ci/common.txt

@@ -4,7 +4,7 @@
 
 # aiohttp is a dependency of etcd3-py
 aiohttp>=3.13.5,<3.14.0; python_version < '3.10'
-aiohttp>=3.14.1; python_version >= '3.10'
+aiohttp>=3.14.3; python_version >= '3.10'
 apache-libcloud>=3.8.0,<3.9.1; sys_platform != 'win32' and python_version < '3.10'
 apache-libcloud>=3.9.1; sys_platform != 'win32' and python_version >= '3.10'
 # bcrypt is an extra requirement for passlib, and we shouldn't use extras, like, passlib[bcrypt]
@@ -14,22 +14,22 @@ bcrypt
 # our urllib3 floor is 2.6.3 so we skip the boto3 cloud module tests on
 # 3.9 by not pinning it here. The bare `boto3` package is still
 # available transitively for any tool that needs it.
-boto3>=1.43.24; python_version >= '3.10'
+boto3>=1.43.96; python_version >= '3.10'
 boto>=2.49.0
 # botocore 1.43.24 requires Python>=3.10. The only versions available on
 # 3.9 (botocore<1.43) hard-pin urllib3<1.27, which conflicts with our
 # urllib3>=2.6.3 floor. Drop botocore on 3.9 like boto3.
-botocore>=1.43.24; python_version >= '3.10'
+botocore>=1.43.96; python_version >= '3.10'
 cryptography>=46.0.7,<48.0.0; python_version < '3.10'
-cryptography>=48.0.0; python_version >= '3.10'
-cffi>=2.0.0
+cryptography>=50.0.1; python_version >= '3.10'
+cffi>=2.1.1
 cherrypy>=18.10.0
 clustershell
 dnspython
 etcd3-py==0.1.6
 filelock>=3.19.1 ; python_version < '3.10'
-filelock>=3.29.1 ; python_version >= '3.10'
-gitpython>=3.1.50
+filelock>=3.32.7 ; python_version >= '3.10'
+gitpython>=3.1.62
 google-auth==2.35.0; python_version == '3.9'
 jmespath>=1.1.0
 jsonschema
@@ -43,39 +43,39 @@ kazoo; sys_platform != 'win32' and sys_platform != 'darwin'
 keyring==25.7.0
 pyasn1-modules==0.4.0; python_version == '3.9'
 kubernetes>=35.0.0,<36.0.0; python_version < '3.10'
-kubernetes>=36.0.2; python_version >= '3.10'
+kubernetes>=36.0.3; python_version >= '3.10'
 libnacl>=2.1.0; sys_platform != 'win32' and sys_platform != 'darwin'
 # markdown-it-py constraint for py3.9: myst-docutils (docs requirement) needs <3.0.0,
 # but netmiko (from napalm, only in py3.9) pulls in rich which wants 3.0.0+
 markdown-it-py<3.0.0; python_version == '3.9'
 moto>=5.1.8,<5.2.0; python_version < '3.10'
-moto>=5.2.2; python_version >= '3.10'
+moto>=5.2.3; python_version >= '3.10'
 # Napalm pulls in pyeapi which does not work on Py3.10
 napalm; sys_platform != 'win32' and python_version < '3.10'
 paramiko>=5.0.0; sys_platform != 'win32' and sys_platform != 'darwin'
 passlib>=1.7.4
 pycryptodomex
-pynacl>=1.5.0
+pynacl>=1.6.2
 pyinotify>=0.9.6; sys_platform != 'win32' and sys_platform != 'darwin' and platform_system != "openbsd"
 python-etcd>=0.4.5
 pyvmomi
 rfc3339-validator>=0.1.4
 rfc3987
-sqlparse>=0.5.5
+sqlparse>=0.6.0
 strict_rfc3339>=0.7
 textfsm
 toml
 # vcert 0.18.x adds hard pins on cryptography, pynacl, and six that
 # conflict with every other CI requirement; stay on 0.9.x.
-vcert~=0.9.0; sys_platform != 'win32'
+vcert~=0.9.1; sys_platform != 'win32'
 virtualenv>=21.4.2,<21.5.1; python_version < '3.10'
-virtualenv>=21.4.2; python_version >= '3.10'
+virtualenv>=21.7.10; python_version >= '3.10'
 watchdog>=6.0.0
-websocket-client>=1.9.0
+websocket-client>=1.9.2
 # werkzeug is a dependency of moto
 werkzeug>=3.1.8
 xmldiff>=2.7.0,<3.0; python_version < '3.10'
-xmldiff>=2.7.0; python_version >= '3.10'
+xmldiff>=3.0; python_version >= '3.10'
 # Available template libraries that can be used
 genshi>=0.7.11
 cheetah3>=3.2.6.post1

requirements/static/ci/darwin.txt

@@ -1,9 +1,9 @@
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.20.1; python_version >= '3.11'
 yamllint
-mercurial>=7.2.2
+mercurial>=7.2.4
 hglib
 # Pin versions to match 3007.x
 apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
 apache-libcloud>=3.9.1; python_version >= '3.10'
-gitpython>=3.1.50
+gitpython>=3.1.62

requirements/static/ci/freebsd.txt

@@ -1,5 +1,5 @@
 # FreeBSD static CI requirements
 
 yamllint
-mercurial>=7.2.2
+mercurial>=7.2.4
 hglib

requirements/static/ci/lint.txt

@@ -1,12 +1,12 @@
 # Lint requirements
 
-docker >= 7.1.0; python_version >= '3.8'
+docker >= 7.2.0; python_version >= '3.8'
 docker < 7.1.0; python_version < '3.8'
 # pylint 4 introduces new default-on E0606/E0601/E0602 checks
 # (possibly-used-before-assignment / used-before-assignment) that the
 # Salt 3008.x codebase has not been audited for; bumping to 4.x turns
 # pre-existing warnings into hard CI failures across salt/, tools/,
 # and tests/. Cap to ~=3.1.0 until the codebase is audited.
-pylint~=3.1.0
+pylint~=3.3.9
 SaltPyLint>=2024.2.5
 toml

requirements/static/ci/linux.txt

@@ -1,7 +1,7 @@
 # Linux static CI requirements
 pyiface
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.20.1; python_version >= '3.11'
 pymysql>=1.2.0
 # ansible release lines support different Python versions:
 #   ansible-core / ansible 10.x — Python 3.10+ (controller and managed)
@@ -17,12 +17,12 @@ pymysql>=1.2.0
 # Python 3.10+ as a controller and installs cleanly on the py3.11 onedir.
 # See PR #69527 / issue #69526.
 ansible>=10.7.0,<11.0.0; python_version >= '3.10' and python_version < '3.12'
-ansible>=14.0.0; python_version >= '3.12'
-twilio>=9.10.9
+ansible>=14.4.0; python_version >= '3.12'
+twilio>=9.11.1
 python-telegram-bot>=20.3,<22.0; python_version < '3.10'
-python-telegram-bot>=22.7; python_version >= '3.10'
+python-telegram-bot>=22.8; python_version >= '3.10'
 yamllint
-mercurial>=7.2.2
+mercurial>=7.2.4
 hglib
 redis
 python-consul