Bump the all-pip-updates group across 3 directories with 107 updates

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dwoz]

CI red. Three concrete blockers, all upstream-floor vs lockfile/tooling
mismatches:

1. cryptography>=48.0.0 in requirements/base.txt — cryptography 48
   dropped py3.9. 3008.x still ships requirements/static/pkg/py3.9/ and
   requirements/static/ci/py3.9/. uv pip compile for every py3.9 lock
   fails with ResolutionImpossible (pre-commit job, all 24 py3.9
   pip-compile hooks). Either gate the floor cryptography>=48.0.0; python_version >= '3.10' (keep an older floor for py3.9) or drop py3.9
   from the matrix on 3008.x.
2. pip == 26.0.1 in requirements/constraints.txt — tools/pkg/build.py
   hard-codes a pip==25.2 CVE-patched wheel for relenv onedirs
   (urllib3 vendored-CVE patcher). With the new constraint, onedir build
   hits ResolutionImpossible: pip 25.2 vs constraint pip==26.0.1 on
   every platform. Either pin constraints to pip==25.2 (revert) or
   bump the patcher in tools/pkg/build.py to 26.0.1.
3. py3.14 lockfiles (requirements/static/pkg/py3.14/*.lock,
   requirements/static/ci/py3.14/*.lock) still have croniter==6.0.0
   but base.txt now requires >=6.2.2. Docs / source-tarball jobs
   hit ResolutionImpossible on croniter. pre-commit regenerates these
   correctly but the regen wasn't included in the bot commit.

Secondary: importlib-metadata floor under python_version < '3.11'
hits the yanked 4.8.0 release because no upper bound is set. Add an
upper or move the floor.

Recommendation: split this rollup. Land the security-driven bumps
(cryptography, urllib3, pyopenssl) separately from framework bumps
(pytest, sphinx, pylint, mock, paramiko). On a patch branch, dropping
py3.9 support through a floor bump is a breaking change for downstream
package consumers.

[dwoz]

Pushed 78f47a0 directly to this branch — mirrors the fix bundle landed in commit 47c49fb on PR #69393's (3006.x) dependabot branch.

Source-file changes:

• base.txt: per-Python caps for cryptography (cap <48 for py<3.10), aiohttp (cap <3.14 for py<3.10), apache-libcloud (cap <3.9.1 for py<3.10), importlib-metadata (cap <9.0 for py<3.10), more-itertools (cap <11 for py<3.10), pycparser (cap <3.0 for py<3.10), pymssql (cap <=2.3.11 for win32+py<3.11 — 2.3.12+ dropped cp3X-win32 wheels and 3008.x still ships an x86 Windows onedir), PyYAML floor 6.0.3, virtualenv floor 21.4.2, filelock pin 3.29.1 for py>=3.10 / 3.19.1<3.29 for py<3.10.
• static/ci/common.txt: same caps + boto3/botocore drop py<3.10, kubernetes cap <36 for py<3.10, moto cap <5.2 for py<3.10, markdown-it-py<3.0 for py3.9 (myst-docutils cascade), vcert revert to ~=0.9.0 (0.18.x hard-pins cryptography==45.0.7 conflict), pynacl revert to >=1.5.0. Also collapses duplicate vcert/virtualenv/watchdog/werkzeug/xmldiff blocks left over from a stale merge.
• static/ci/{cloud,darwin,docs,linux,windows}.txt: per-Python caps for apache-libcloud, pygit2, sphinx, sphinxcontrib-httpdomain, python-telegram-bot. ansible release-line ladder clamped (7.x py3.9, 10.x py3.10, 12.x py3.11, 14.x py3.12+).
• static/pkg/{linux,freebsd}.txt: cryptography/importlib-metadata/more-itertools/pycparser per-Python caps.
• tools/pkg/build.py: drop PIP_CONSTRAINT for the pip-download and force-reinstall of the urllib3-CVE-patched pip 25.2 wheel. constraints.txt pins pip==26.0.1; without dropping PIP_CONSTRAINT the install fails with ResolutionImpossible.

shutil.rmtree onexc/onerror handling is already in the 3008.x baseline (different style but functionally equivalent to the 3006.x change).

Regenerated 64 lockfiles across py3.9-3.14 pkg + ci.

Committed with SKIP for maintainer-attention items only:

• compile-ci-{linux,freebsd,darwin,windows}-3.9-zmq-requirements / compile-ci-cloud-3.9-requirements / compile-ci-lint-3.9-requirements — urllib3 2.6.3 (Salt floor) vs botocore 1.43+'s urllib3<1.27 chain on py3.9. Either drop boto3/botocore from py3.9 entirely or wait for botocore to publish a py3.9 release that allows urllib3 2.x.
• compile-doc-requirements — py3.9 + py3.10 docs locks hit a myst-docutils[linkify] vs jaraco-text==4.2.0 cascade. Maintainer needs to pin myst-docutils or drop py3.9/3.10 from the docs matrix. py3.11+ docs locks regenerated cleanly.
• lint-salt / lint-tests — local pre-commit nox env hit a pip 26.0.1 internal-module change; CI runs in a fresh venv so this is a local-cache artefact only.

No --no-verify. #69400 will be closed as superseded by this push.

[dwoz]

Pushed ef13ed8 directly to this branch — closes the SKIP gaps from 78f47a0 so pre-commit runs cleanly end-to-end (exit 0, no SKIP, no --no-verify) locally.

Five targeted fixes:

1. pylint cap ~=3.1.0 in requirements/static/ci/lint.txt. 4.0.5 introduces default-on E0606 / E0601 checks that the 3008.x codebase has dozens of pre-existing occurrences of (setup.py, salt/minion.py, salt/states/git.py, salt/states/file.py, salt/states/ssh_pki.py, etc. — see the 80207200176 Lint Salt log). Lint runs in a Py3.10 container so a py<3.10 marker would not help; the cap is unconditional.

2. urllib3 floor for py<3.10 reverted to >=1.26.20,<2.0.0. The >=2.6.3 floor breaks botocore on py3.9 (hard-requires urllib3<2). py>=3.10 still gets >=2.7.0 with the CVE-2025-66418 / CVE-2026-21441 backports.

3. markdown-it-py < 4.0.0 for py3.10 added to constraints.txt. myst-docutils 4.x (latest supporting py3.10) pins markdown-it-py ~=3.0; without the cap the py3.10 docs lock would resolve to 4.2.0 transitively via rich.

4. pip pin reverted to == 25.2 in constraints.txt. 26.0.1 corrupted the lint-{salt,tests}-pre-commit hook venv on Py3.14 (the bundled pygments wheel is missing the modeline submodule on cpython 3.14, breaking the very next pip invocation). 25.2 is also the version relenv ships and that tools/pkg/build.py patches.

5. tests/pytests/unit/utils/test_cloud.py CustomKeyring: keyring 25 made priority an abstract class attribute and now requires super().init(). Update the stub so lint-tests stops flagging W0223 / W0231.

Plus two pre-existing pyupgrade rewrites in salt/cache/redis_cache.py and tests/pytests/unit/cache/test_redis_cache.py ("{0}".format → "{}".format) that the local pre-commit surfaces.

Mirrors the equivalent fix bundle landed on #69393 (df7f933) for 3006.x.

[welcome]

Congratulations on your first PR being merged! 🎉