fix: upgrade certifi to 2026.10.19 and pip to 26.2.2 (eMudhra CA removal) (#232)

The emSign root CA is removed from certifi 2026.10.19 after the eMudhra
security incident (GHSA-6q48-6c7w-9gw2). pip vendors its own certifi, so
pip must be upgraded to 26.2.2 as well. pip-tools is bumped to 7.6.2,
the first release that works with pip 26.2.x.

Ticket: LP-1401

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: vgulati-apphelix

requirements/constraints.txt

@@ -15,4 +15,4 @@
 # Make upgrade command and all requirements upgrade jobs are broken due to this.
 # See issue https://github.com/edx/devstack/issues/195 for details regarding the ongoing fix.
 # The constraint can be removed once a release (pip-tools > 7.5.1) is available with support for pip 25.3
-pip<25.3
+pip<=26.2.2  # Known to work with pip-tools==7.6.2

requirements/dev.txt

@@ -38,7 +38,7 @@ packaging==25.0
     #   tox
 pexpect==4.9.0
     # via -r requirements/test.txt
-pip-tools==7.5.1
+pip-tools==7.6.2
     # via -r requirements/pip-tools.txt
 platformdirs==4.5.0
     # via

requirements/doc.txt

@@ -14,7 +14,7 @@ babel==2.17.0
     #   sphinx
 beautifulsoup4==4.14.2
     # via pydata-sphinx-theme
-certifi==2025.10.5
+certifi==2026.10.19
     # via requests
 charset-normalizer==3.4.4
     # via requests

requirements/pip-tools.txt

@@ -10,7 +10,7 @@ click==8.3.0
     # via pip-tools
 packaging==25.0
     # via build
-pip-tools==7.5.1
+pip-tools==7.6.2
     # via -r requirements/pip-tools.in
 pyproject-hooks==1.2.0
     # via

requirements/pip.txt

@@ -8,9 +8,10 @@ wheel==0.45.1
     # via -r requirements/pip.in
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==25.2
+pip==26.2.2
     # via
     #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+    #   -c requirements/constraints.txt
     #   -r requirements/pip.in
 setuptools==80.9.0
     # via -r requirements/pip.in