Bump the all-pip-updates group across 3 directories with 82 updates

.pre-commit-config.yaml

@@ -225,7 +225,7 @@ repos:
           - requirements/crypto.txt
           - requirements/static/pkg/linux.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -335,7 +335,7 @@ repos:
           - requirements/crypto.txt
           - requirements/static/pkg/freebsd.txt
           - --universal
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -445,7 +445,7 @@ repos:
           - requirements/crypto.txt
           - requirements/static/pkg/darwin.txt
           - --python-platform=macos
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -556,7 +556,7 @@ repos:
           - requirements/windows.txt
           - requirements/static/pkg/windows.txt
           - --python-platform=windows
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -675,7 +675,7 @@ repos:
           - requirements/static/ci/common.txt
           - requirements/static/ci/linux.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -802,7 +802,7 @@ repos:
         args:
           - requirements/static/ci/crypto.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -899,7 +899,7 @@ repos:
           - requirements/static/ci/freebsd.txt
           - requirements/static/pkg/freebsd.txt
           - --universal
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1030,7 +1030,7 @@ repos:
         args:
           - requirements/static/ci/crypto.txt
           - --universal
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1128,7 +1128,7 @@ repos:
           - requirements/static/ci/common.txt
           - requirements/static/ci/darwin.txt
           - --python-platform=macos
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1258,7 +1258,7 @@ repos:
         args:
           - requirements/static/ci/crypto.txt
           - --python-platform=macos
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1355,7 +1355,7 @@ repos:
           - requirements/static/ci/common.txt
           - requirements/static/ci/windows.txt
           - --python-platform=windows
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1485,7 +1485,7 @@ repos:
         args:
           - requirements/static/ci/crypto.txt
           - --python-platform=windows
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1590,7 +1590,7 @@ repos:
           - requirements/static/ci/cloud.txt
           - requirements/static/pkg/linux.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1735,7 +1735,7 @@ repos:
           - requirements/crypto.txt
           - requirements/static/ci/docs.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -1866,7 +1866,7 @@ repos:
           - requirements/static/ci/linux.txt
           - requirements/static/pkg/linux.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -2006,7 +2006,7 @@ repos:
         args:
           - requirements/static/ci/changelog.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -2112,7 +2112,7 @@ repos:
         args:
           - requirements/static/ci/tools.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -2204,7 +2204,7 @@ repos:
         args:
           - requirements/static/ci/tools-virustotal.txt
           - --python-platform=linux
-          - --python-version=3.9
+          - --python-version=3.9.2
           - --constraint
           - requirements/constraints.txt
           - --no-emit-index-url
@@ -2470,10 +2470,10 @@ repos:
           # Pip/setuptools pins must run on the hook interpreter (Python 3.12+ in CI):
           # pip 20.x still imports distutils, removed from the stdlib in 3.12.
           # pip 23.x trips on Py 3.14 metadata parsing; 25.x is needed.
-          # Pip must match requirements/constraints.txt (pip == 25.2) so the
+          # Pip must match requirements/constraints.txt (pip == 26.0.1) so the
           # noxfile's PIP_CONSTRAINT install does not try to downgrade.
           - setuptools>=80.10.2
-          - pip==25.2
+          - pip==26.0.1
 
   - repo: local
     hooks:
@@ -2491,8 +2491,8 @@ repos:
           # Pip/setuptools pins must run on the hook interpreter (Python 3.12+ in CI):
           # pip 20.x still imports distutils, removed from the stdlib in 3.12.
           # pip 23.x trips on Py 3.14 metadata parsing; 25.x is needed.
-          # Pip must match requirements/constraints.txt (pip == 25.2) so the
+          # Pip must match requirements/constraints.txt (pip == 26.0.1) so the
           # noxfile's PIP_CONSTRAINT install does not try to downgrade.
           - setuptools>=80.10.2
-          - pip==25.2
+          - pip==26.0.1
   # <---- Pre-Commit -------------------------------------------------------------------------------------------------

changelog/69391.fixed.md

@@ -0,0 +1 @@
+Fix `pip.installed` raising `InvalidEggFragment` against pip 26+ when a VCS or URL package is given with an inline `#egg=name<spec>` version specifier. Salt now strips the specifier from the egg fragment before calling pip's parser and preserves it as the package's version spec.

requirements/base.txt

@@ -1,74 +1,90 @@
 # Dependencies are listed alphabetically by package name.
 # Multiple entries for the same package (with different version constraints) are grouped together.
 
-aiohttp>=3.13.3
-apache-libcloud>=3.8.0
+aiohttp>=3.13.5,<3.14.0; python_version < '3.10'
+aiohttp>=3.14.1; python_version >= '3.10'
+apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
+apache-libcloud>=3.9.1; python_version >= '3.10'
 cffi>=2.0.0
 # cheroot 8.5.2 fails to build with modern setuptools due to setuptools_scm_git_archive dependency
-cheroot>=10.0.1
-cherrypy>=18.6.1
+cheroot>=11.1.2
+cherrypy>=18.10.0
 # We need contextvars for salt-ssh
 contextvars; python_version < '3.7'
-croniter>=0.3.0,!=0.3.22; sys_platform != 'win32'
-cryptography>=46.0.7
-distro>=1.0.1
-frozenlist>=1.3.0; python_version < '3.11'
+croniter!=0.3.22,>=6.2.2; sys_platform != 'win32'
+# cryptography 48.0.0 drops support for Python 3.9.0 and 3.9.1
+# (only >3.9.1 is accepted). The py3.9 lock files now compile against
+# --python-version=3.9.2 so 48 resolves there too, but the per-Python
+# split is kept for documentation and to match the cross-branch pattern
+# used on 3006.x/3007.x/3008.x.
+cryptography>=46.0.7,<48.0.0; python_version < '3.10'
+cryptography>=48.0.0; python_version >= '3.10'
+distro>=1.9.0
+frozenlist>=1.8.0; python_version < '3.11'
 frozenlist>=1.5.0; python_version >= '3.11'
 gitpython>=3.1.50
-idna>=2.8
+idna>=3.18
 immutables>=0.21; python_version < '3.7'
 importlib-metadata>=3.3.0; python_version < '3.11'
 importlib-metadata>=8.7.0; python_version >= '3.11'
-jaraco.functools>=4.1.0
-jaraco.context>=6.1.0
-jaraco.text>=4.0.0
-Jinja2>=3.1.5
+jaraco.functools>=4.4.0
+jaraco.context>=6.1.1
+jaraco.text>=4.2.0
+Jinja2>=3.1.6
 jmespath>=1.1.0
 looseversion
-lxml>=6.1.0; sys_platform == 'win32'
-MarkupSafe<3.0.0; python_version < '3.14'
+lxml>=6.1.1; sys_platform == 'win32'
+MarkupSafe<4.0.0; python_version < '3.14'
 MarkupSafe<4.0.0; python_version >= '3.14'
-more-itertools>=9.1.0
-msgpack>=1.0.0 ; python_version < '3.13'
+more-itertools>=10.8.0
+msgpack>=1.1.2 ; python_version < '3.13'
 msgpack>=1.1.0 ; python_version >= '3.13'
-opentelemetry-api>=1.30.0
-opentelemetry-sdk>=1.30.0
-opentelemetry-exporter-otlp-proto-http>=1.30.0
-opentelemetry-exporter-prometheus>=0.51b0
-xxhash>=3.0.0
+opentelemetry-api>=1.41.1
+opentelemetry-sdk>=1.41.1
+opentelemetry-exporter-otlp-proto-http>=1.41.1
+opentelemetry-exporter-prometheus>=0.62b1
+xxhash>=3.7.0
 # Packaging 24.1 imports annotations from __future__ which breaks salt ssh
 # tests on target hosts with older python versions.
-packaging>=21.3; python_version < '3.11'
+packaging>=26.2; python_version < '3.11'
 packaging==24.0; python_version >= '3.11' and python_version < '3.14'
 packaging>=26.0,<27.0; python_version >= '3.14'
 psutil<6.0.0; python_version <= '3.9'
 psutil>=5.0.0; python_version >= '3.10'
 pyasn1>=0.6.3
-pycparser>=2.21
+pycparser>=2.23
 pymssql>=2.2.1; sys_platform == 'win32' and python_version < '3.11'
 pymssql==2.3.11; sys_platform == 'win32' and python_version >= '3.11'
-pyopenssl>=26.0.0
-python-dateutil>=2.8.1
-python-gnupg>=0.4.7
+pyopenssl>=26.2.0
+python-dateutil>=2.9.0.post0
+python-gnupg>=0.5.6
 pythonnet>=3.0.1; sys_platform == 'win32' and python_version < '3.11'
 pythonnet>=3.0.4; sys_platform == 'win32' and python_version >= '3.11' and python_version < '3.13'
 pythonnet>=3.1.0rc0; sys_platform == 'win32' and python_version >= '3.13'
-pywin32>=305; sys_platform == 'win32'
-pycryptodomex>=3.9.8
-PyYAML
-requests>=2.25.1; python_version < '3.10'
+pywin32>=312; sys_platform == 'win32'
+pycryptodomex>=3.23.0
+PyYAML>=6.0.3
+requests>=2.32.5; python_version < '3.10'
 requests<2.32.0 ; python_version >= '3.10' and python_version < '3.11'
 requests>=2.32.5 ; python_version >= '3.11'
 rpm-vercmp; sys_platform == 'linux'
-setproctitle>=1.2.3
-timelib>=0.2.5; python_version < '3.11'
+setproctitle>=1.3.7
+timelib>=0.3.0; python_version < '3.11'
 timelib>=0.3.0; python_version >= '3.11'
-tornado>=6.5.5
+tornado>=6.5.6
 truststore>=0.10.0; python_version >= "3.10"
+# Python 3.9 stays on urllib3 1.26.x because botocore on py3.9 hard
+# requires urllib3 < 2 and Salt still builds a py3.9 onedir. The
+# Python 3.10+ floor carries the urllib3 2.6.3 CVE backports
+# (CVE-2025-66418, CVE-2026-21441).
 urllib3>=1.26.20,<2.0.0; python_version < '3.10'
 urllib3>=2.7.0; python_version >= '3.10'
-virtualenv
+virtualenv>=21.4.2
+# Transitive of virtualenv; some uv resolver caches pin a stale 3.25
+# version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
+filelock>=3.29.1; python_version >= '3.10'
+filelock>=3.19.1,<3.29.0; python_version < '3.10'
 vultr>=1.0.1
 wmi>=1.5.1; sys_platform == 'win32'
-xmltodict>=0.13.0; sys_platform == 'win32'
-zipp>=3.19.1
+xmltodict>=1.0.4; sys_platform == 'win32'
+zipp>=3.23.1

requirements/build.txt

@@ -1,2 +1,2 @@
 twine
-build>=0.7.0
+build>=1.4.4

requirements/constraints.txt

@@ -1,7 +1,7 @@
 # IMPORTANT: The versions here must be compatible with the environment where
 # uv-pre-commit hooks run. We do not pin setuptools in .pre-commit-config.yaml
 # to allow uv to resolve a version that satisfies these constraints.
-wheel >= 0.46.3
+wheel >= 0.47.0
 # Floor at the CVE fix: 78.1.1 patches GHSA-5rjg-fvgr-3xxf
 # (PYSEC-2025-49) -- path traversal in setuptools.PackageIndex.download.
 # A higher floor (e.g. 80.x) makes the PEP 517 build-env install fail
@@ -10,5 +10,9 @@ wheel >= 0.46.3
 # bootstraps build envs with), e.g. yarl on Python 3.14 where no cp314
 # wheel is available under salt's ``--no-binary=:all:`` policy.
 setuptools >= 78.1.1
-pip == 25.2
+pip == 26.0.1
 markdown-it-py < 3.0.0; python_version == "3.9"
+# myst-docutils 4.x (the latest supporting Python 3.10) requires
+# markdown-it-py ~=3.0; the 5.x line that pairs with markdown-it-py
+# 4.x only supports Python >=3.11.
+markdown-it-py < 4.0.0; python_version == "3.10"

requirements/crypto.txt

@@ -1,2 +1,2 @@
 
-pycryptodomex>=3.9.8
+pycryptodomex>=3.23.0

requirements/pytest.txt

@@ -1,12 +1,12 @@
-mock >= 3.0.0
+mock >= 5.2.0
 # PyTest
 docker >= 7.1.0; python_version >= '3.8'
 docker < 7.1.0; python_version < '3.8'
-pytest >= 7.2.0
-pytest-salt-factories >= 1.0.3
-pytest-helpers-namespace >= 2019.1.8
+pytest >= 8.4.2
+pytest-salt-factories >= 1.0.5
+pytest-helpers-namespace >= 2021.12.29
 pytest-subtests
-pytest-timeout >= 2.3.1
+pytest-timeout >= 2.4.0
 pytest-httpserver
 pytest-custom-exit-code >= 0.3
 flaky

requirements/static/ci/changelog.txt

@@ -1,3 +1,3 @@
-towncrier==24.8.0
+towncrier==25.8.0
 looseversion
 packaging

requirements/static/ci/cloud.txt

@@ -1,5 +1,6 @@
 # Cloud tests requirements
-apache-libcloud>=3.8.0
+apache-libcloud>=3.8.0,<3.9.1; python_version < '3.10'
+apache-libcloud>=3.9.1; python_version >= '3.10'
 netaddr
 profitbricks
 pypsexec