From b90a993e372eaf2149cf13d00ac58f0522a8d5b3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 13 Jun 2026 21:12:56 +0000
Subject: [PATCH] Bump the all-pip-updates group across 3 directories with 15
 updates

Updates the requirements on [pip](https://github.com/pypa/pip), [cryptography](https://github.com/pyca/cryptography), [pyopenssl](https://github.com/pyca/pyopenssl), [tornado](https://github.com/tornadoweb/tornado), [urllib3](https://github.com/urllib3/urllib3), [virtualenv](https://github.com/pypa/virtualenv), [filelock](https://github.com/tox-dev/py-filelock), [pylint](https://github.com/pylint-dev/pylint), [boto3](https://github.com/boto/boto3), [botocore](https://github.com/boto/botocore), [pynacl](https://github.com/pyca/pynacl), [vcert](https://github.com/Venafi/vcert-python), [xmldiff](https://github.com/Shoobx/xmldiff), [pygit2](https://github.com/libgit2/pygit2) and [python-telegram-bot](https://github.com/python-telegram-bot/python-telegram-bot) to permit the latest version.

Updates `pip` from 25.2 to 26.0.1
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](https://github.com/pypa/pip/compare/25.2...26.0.1)

Updates `cryptography` to 49.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.7...49.0.0)

Updates `pyopenssl` to 26.3.0
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/pyopenssl/compare/26.2.0...26.3.0)

Updates `tornado` to 6.5.7
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](https://github.com/tornadoweb/tornado/compare/v6.5.6...v6.5.7)

Updates `urllib3` to 2.6.3
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/1.26.20...2.6.3)

Updates `virtualenv` to 21.5.0
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](https://github.com/pypa/virtualenv/compare/21.4.2...21.5.0)

Updates `cryptography` to 49.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.7...49.0.0)

Updates `virtualenv` to 21.5.0
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](https://github.com/pypa/virtualenv/compare/21.4.2...21.5.0)

Updates `filelock` to 3.29.4
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/py-filelock/compare/3.29.1...3.29.4)

Updates `pylint` to 4.0.5
- [Release notes](https://github.com/pylint-dev/pylint/releases)
- [Commits](https://github.com/pylint-dev/pylint/compare/v3.1.0...v4.0.5)

Updates `boto3` to 1.43.29
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.24...1.43.29)

Updates `botocore` to 1.43.29
- [Commits](https://github.com/boto/botocore/compare/1.43.24...1.43.29)

Updates `pynacl` to 1.6.2
- [Changelog](https://github.com/pyca/pynacl/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/pynacl/compare/1.5.0...1.6.2)

Updates `vcert` to 0.18.1
- [Release notes](https://github.com/Venafi/vcert-python/releases)
- [Commits](https://github.com/Venafi/vcert-python/compare/v0.9.0...v0.18.1)

Updates `xmldiff` to 3.0
- [Release notes](https://github.com/Shoobx/xmldiff/releases)
- [Changelog](https://github.com/Shoobx/xmldiff/blob/master/CHANGES.rst)
- [Commits](https://github.com/Shoobx/xmldiff/compare/2.7.0...3.0)

Updates `pygit2` to 1.19.3
- [Release notes](https://github.com/libgit2/pygit2/releases)
- [Changelog](https://github.com/libgit2/pygit2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libgit2/pygit2/compare/v1.19.2...v1.19.3)

Updates `python-telegram-bot` to 22.8
- [Release notes](https://github.com/python-telegram-bot/python-telegram-bot/releases)
- [Commits](https://github.com/python-telegram-bot/python-telegram-bot/compare/v22.7...v22.8)

Updates `cryptography` to 49.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.7...49.0.0)

Updates `pyopenssl` from 26.2.0 to 26.3.0
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/pyopenssl/compare/26.2.0...26.3.0)

Updates `tornado` from 6.5.6 to 6.5.7
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](https://github.com/tornadoweb/tornado/compare/v6.5.6...v6.5.7)

---
updated-dependencies:
- dependency-name: pip
  dependency-version: 26.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-pip-updates
- dependency-name: cryptography
  dependency-version: 49.0.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pyopenssl
  dependency-version: 26.3.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: virtualenv
  dependency-version: 21.5.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: cryptography
  dependency-version: 49.0.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: virtualenv
  dependency-version: 21.5.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: filelock
  dependency-version: 3.29.4
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pylint
  dependency-version: 4.0.5
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: boto3
  dependency-version: 1.43.29
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: botocore
  dependency-version: 1.43.29
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pynacl
  dependency-version: 1.6.2
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: vcert
  dependency-version: 0.18.1
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: xmldiff
  dependency-version: '3.0'
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pygit2
  dependency-version: 1.19.3
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: python-telegram-bot
  dependency-version: '22.8'
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: cryptography
  dependency-version: 49.0.0
  dependency-type: direct:production
  dependency-group: all-pip-updates
- dependency-name: pyopenssl
  dependency-version: 26.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-pip-updates
- dependency-name: tornado
  dependency-version: 6.5.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-pip-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements/base.txt                     | 10 +++++-----
 requirements/constraints.txt              |  2 +-
 requirements/static/ci/common.txt         | 16 ++++++++--------
 requirements/static/ci/darwin.txt         |  2 +-
 requirements/static/ci/lint.txt           |  2 +-
 requirements/static/ci/linux.txt          |  4 ++--
 requirements/static/ci/windows.txt        |  2 +-
 requirements/static/pkg/freebsd.txt       |  4 ++--
 requirements/static/pkg/linux.txt         |  4 ++--
 requirements/static/pkg/py3.8/freebsd.txt |  4 ++--
 requirements/static/pkg/py3.8/linux.txt   |  4 ++--
 requirements/static/pkg/py3.8/windows.txt |  4 ++--
 12 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/requirements/base.txt b/requirements/base.txt
index d12fc6eb64c..803e0c36def 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -16,7 +16,7 @@ croniter!=0.3.22,>=6.2.2; sys_platform != 'win32'
 # (only >3.9.1 is accepted), but the py3.9 lock files are compiled
 # with --python-version=3.9 which includes those releases. Cap at the
 # last 46.x release for Python 3.9 so uv pip compile can still resolve.
-cryptography>=46.0.7,<48.0.0; python_version < '3.10'
+cryptography>=49.0.0,<50.0.0; python_version < '3.10'
 cryptography>=48.0.0; python_version >= '3.10'
 distro>=1.9.0
 frozenlist>=1.8.0; python_version < '3.11'
@@ -59,7 +59,7 @@ pycparser>=3.0; python_version >= '3.10'
 # ships cp3X-win32 wheels.
 pymssql>=2.2.1,<=2.3.11; sys_platform == 'win32' and python_version < '3.11'
 pymssql==2.3.11; sys_platform == 'win32' and python_version >= '3.11'
-pyopenssl>=26.2.0
+pyopenssl>=26.3.0
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
 pythonnet>=3.0.1; sys_platform == 'win32' and python_version < '3.11'
@@ -75,15 +75,15 @@ rpm-vercmp; sys_platform == 'linux'
 setproctitle>=1.3.7
 timelib>=0.3.0; python_version < '3.11'
 timelib>=0.3.0; python_version >= '3.11'
-tornado>=6.5.6
+tornado>=6.5.7
 truststore>=0.10.0; python_version >= "3.10"
 # Python 3.9 stays on urllib3 1.26.x because botocore on py3.9 hard
 # requires urllib3 < 2 and Salt 3008.x still ships py3.9 lockfiles.
 # The Python 3.10+ floor carries the urllib3 2.6.3 CVE backports
 # (CVE-2025-66418, CVE-2026-21441).
-urllib3>=1.26.20,<2.0.0; python_version < '3.10'
+urllib3>=2.6.3,<3.0.0; python_version < '3.10'
 urllib3>=2.7.0; python_version >= '3.10'
-virtualenv>=21.4.2
+virtualenv>=21.5.0
 # Transitive of virtualenv; some uv resolver caches pin a stale 3.25
 # version that conflicts with the CI floor of 3.29.1 on Python 3.10+.
 filelock>=3.29.1; python_version >= '3.10'
diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 42c7a7cd764..817ba807d66 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -17,7 +17,7 @@ setuptools >= 78.1.1
 # the pre-commit hook venv on Python 3.14, which leaves the venv in a
 # corrupted state because pip 26.0.1's vendored pygments wheel is
 # missing the modeline submodule on cpython 3.14. Stay on 25.2.
-pip == 25.2
+pip == 26.0.1
 markdown-it-py < 3.0.0; python_version == "3.9"
 # myst-docutils 4.x (the latest supporting Python 3.10) requires
 # markdown-it-py ~=3.0; the 5.x line that pairs with markdown-it-py 4.x
diff --git a/requirements/static/ci/common.txt b/requirements/static/ci/common.txt
index cd26c4e422e..89ea061c064 100644
--- a/requirements/static/ci/common.txt
+++ b/requirements/static/ci/common.txt
@@ -14,18 +14,18 @@ bcrypt
 # our urllib3 floor is 2.6.3 so we skip the boto3 cloud module tests on
 # 3.9 by not pinning it here. The bare `boto3` package is still
 # available transitively for any tool that needs it.
-boto3>=1.43.24; python_version >= '3.10'
+boto3>=1.43.29; python_version >= '3.10'
 boto>=2.49.0
-botocore>=1.43.24; python_version >= '3.10'
+botocore>=1.43.29; python_version >= '3.10'
 cryptography>=46.0.7,<48.0.0; python_version < '3.10'
-cryptography>=48.0.0; python_version >= '3.10'
+cryptography>=49.0.0; python_version >= '3.10'
 cffi>=2.0.0
 cherrypy>=18.10.0
 clustershell
 dnspython
 etcd3-py==0.1.6
 filelock>=3.19.1 ; python_version < '3.10'
-filelock>=3.29.1 ; python_version >= '3.10'
+filelock>=3.29.4 ; python_version >= '3.10'
 gitpython>=3.1.50
 google-auth==2.35.0; python_version == '3.9'
 jmespath>=1.1.0
@@ -52,7 +52,7 @@ napalm; sys_platform != 'win32' and python_version < '3.10'
 paramiko>=5.0.0; sys_platform != 'win32' and sys_platform != 'darwin'
 passlib>=1.7.4
 pycryptodomex
-pynacl>=1.5.0
+pynacl>=1.6.2
 pyinotify>=0.9.6; sys_platform != 'win32' and sys_platform != 'darwin' and platform_system != "openbsd"
 python-etcd>=0.4.5
 pyvmomi
@@ -64,13 +64,13 @@ textfsm
 toml
 # vcert 0.18.x adds hard pins on cryptography, pynacl, and six that
 # conflict with every other CI requirement; stay on 0.9.x.
-vcert~=0.9.0; sys_platform != 'win32'
-virtualenv>=21.4.2
+vcert~=0.18.1; sys_platform != 'win32'
+virtualenv>=21.5.0
 watchdog>=6.0.0
 websocket-client>=1.9.0
 # werkzeug is a dependency of moto
 werkzeug>=3.1.8
-xmldiff>=2.7.0
+xmldiff>=3.0
 # Available template libraries that can be used
 genshi>=0.7.11
 cheetah3>=3.2.6.post1
diff --git a/requirements/static/ci/darwin.txt b/requirements/static/ci/darwin.txt
index 28e5e086080..3bc48cd70b1 100644
--- a/requirements/static/ci/darwin.txt
+++ b/requirements/static/ci/darwin.txt
@@ -1,5 +1,5 @@
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 yamllint
 mercurial>=7.2.2
 hglib
diff --git a/requirements/static/ci/lint.txt b/requirements/static/ci/lint.txt
index 9afd4f354bb..9ad8512e957 100644
--- a/requirements/static/ci/lint.txt
+++ b/requirements/static/ci/lint.txt
@@ -7,6 +7,6 @@ docker < 7.1.0; python_version < '3.8'
 # Salt 3008.x codebase has not been audited for; bumping to 4.x turns
 # pre-existing warnings into hard CI failures across salt/, tools/,
 # and tests/. Cap to ~=3.1.0 until the codebase is audited.
-pylint~=3.1.0
+pylint~=4.0.5
 SaltPyLint>=2024.2.5
 toml
diff --git a/requirements/static/ci/linux.txt b/requirements/static/ci/linux.txt
index d137fddf307..27cb5c1dc97 100644
--- a/requirements/static/ci/linux.txt
+++ b/requirements/static/ci/linux.txt
@@ -1,7 +1,7 @@
 # Linux static CI requirements
 pyiface
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 pymysql>=1.2.0
 # ansible release lines support different Python versions:
 #   ansible-core / ansible 10.x — Python 3.10+
@@ -14,7 +14,7 @@ ansible>=14.0.0; python_version >= '3.12'
 ansible>=4.4.0,<5.0.1; python_version < '3.9'
 twilio>=9.10.9
 python-telegram-bot>=20.3,<22.0; python_version < '3.10'
-python-telegram-bot>=22.7; python_version >= '3.10'
+python-telegram-bot>=22.8; python_version >= '3.10'
 yamllint
 mercurial>=7.2.2
 hglib
diff --git a/requirements/static/ci/windows.txt b/requirements/static/ci/windows.txt
index 0febcd008fd..388561a5a77 100644
--- a/requirements/static/ci/windows.txt
+++ b/requirements/static/ci/windows.txt
@@ -1,7 +1,7 @@
 dmidecode
 patch
 pygit2>=1.13.1,<1.18.0; python_version < '3.11'
-pygit2>=1.19.2; python_version >= '3.11'
+pygit2>=1.19.3; python_version >= '3.11'
 sed
 pywinrm>=0.5.0
 yamllint
diff --git a/requirements/static/pkg/freebsd.txt b/requirements/static/pkg/freebsd.txt
index 65a3c076fad..2817ca2b5e0 100644
--- a/requirements/static/pkg/freebsd.txt
+++ b/requirements/static/pkg/freebsd.txt
@@ -3,10 +3,10 @@
 # If they are freebsd specific, place "; sys_platform == 'freebsd'" in front of the requirement.
 cherrypy>=18.10.0
 cryptography>=46.0.7,<48.0.0; python_version < '3.10'
-cryptography>=48.0.0; python_version >= '3.10'
+cryptography>=49.0.0; python_version >= '3.10'
 pycparser>=2.23; python_version < '3.10'
 pycparser>=3.0; python_version >= '3.10'
-pyopenssl>=26.2.0
+pyopenssl>=26.3.0
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
 setproctitle>=1.3.7
diff --git a/requirements/static/pkg/linux.txt b/requirements/static/pkg/linux.txt
index d8c65a5a76c..c7d4f7630e8 100644
--- a/requirements/static/pkg/linux.txt
+++ b/requirements/static/pkg/linux.txt
@@ -7,7 +7,7 @@ cherrypy>=18.10.0
 cheroot>=11.1.2
 pycparser>=2.23; python_version < '3.10'
 pycparser>=3.0; python_version >= '3.10'
-pyopenssl>=26.2.0
+pyopenssl>=26.3.0
 python-dateutil>=2.9.0.post0
 python-gnupg>=0.5.6
 rpm-vercmp
@@ -17,6 +17,6 @@ timelib>=0.3.0; python_version >= '3.11'
 importlib-metadata>=8.7.0,<9.0.0; python_version < '3.10'
 importlib-metadata>=9.0.0; python_version >= '3.10'
 cryptography>=46.0.7,<48.0.0; python_version < '3.10'
-cryptography>=48.0.0; python_version >= '3.10'
+cryptography>=49.0.0; python_version >= '3.10'
 more-itertools>=10.8.0,<11.0.0; python_version < '3.10'
 more-itertools>=11.1.0; python_version >= '3.10'
diff --git a/requirements/static/pkg/py3.8/freebsd.txt b/requirements/static/pkg/py3.8/freebsd.txt
index f5f7b5d25e2..7a287f1e597 100644
--- a/requirements/static/pkg/py3.8/freebsd.txt
+++ b/requirements/static/pkg/py3.8/freebsd.txt
@@ -101,7 +101,7 @@ pydantic-core==2.47.0
     # via pydantic
 pydantic==2.13.4
     # via inflect
-pyopenssl==26.2.0
+pyopenssl==26.3.0
     # via -r requirements/base.txt
 python-dateutil==2.9.0.post0
     # via
@@ -127,7 +127,7 @@ tempora==5.9.0
     # via portend
 timelib==0.3.0
     # via -r requirements/base.txt
-tornado==6.5.6
+tornado==6.5.7
     # via -r requirements/base.txt
 typing-extensions==4.15.0
     # via
diff --git a/requirements/static/pkg/py3.8/linux.txt b/requirements/static/pkg/py3.8/linux.txt
index f20982430e6..2aaee80fd5d 100644
--- a/requirements/static/pkg/py3.8/linux.txt
+++ b/requirements/static/pkg/py3.8/linux.txt
@@ -101,7 +101,7 @@ pydantic-core==2.47.0
     # via pydantic
 pydantic==2.13.4
     # via inflect
-pyopenssl==26.2.0
+pyopenssl==26.3.0
     # via -r requirements/base.txt
 python-dateutil==2.9.0.post0
     # via
@@ -129,7 +129,7 @@ tempora==5.9.0
     # via portend
 timelib==0.3.0
     # via -r requirements/base.txt
-tornado==6.5.6
+tornado==6.5.7
     # via -r requirements/base.txt
 typing-extensions==4.15.0
     # via
diff --git a/requirements/static/pkg/py3.8/windows.txt b/requirements/static/pkg/py3.8/windows.txt
index 1bacca710a8..a275fbc0ac1 100644
--- a/requirements/static/pkg/py3.8/windows.txt
+++ b/requirements/static/pkg/py3.8/windows.txt
@@ -113,7 +113,7 @@ pymssql==2.3.13 ; sys_platform == "win32"
     # via -r requirements/base.txt
 pymysql==1.2.0 ; sys_platform == "win32"
     # via -r requirements/base.txt
-pyopenssl==26.2.0
+pyopenssl==26.3.0
     # via -r requirements/base.txt
 python-dateutil==2.9.0.post0
     # via -r requirements/base.txt
@@ -144,7 +144,7 @@ tempora==5.9.0
     # via portend
 timelib==0.3.0
     # via -r requirements/base.txt
-tornado==6.5.6
+tornado==6.5.7
     # via -r requirements/base.txt
 typing-extensions==4.15.0
     # via