Merge upstream/main to unblock pyOpenSSL 26.x bump

[ihalatci]

Summary

Merges upstream mitmproxy/mitmproxy@main into our fork's main to pick up the pyOpenSSL upper-bound bump (mitmproxy#8180 + mitmproxy#8219), unblocking downstream consumers (citusdata/citus → citusdata/the-process) from moving to pyOpenSSL 26.x.

Without this, the-process circleci/images/*/requirements.txt cannot pull pyOpenSSL >= 26.0.0 (which contains CVE fixes CVE-2026-27448 / CVE-2026-27459 / CVE-2026-40475).

What's in the merge

Cap changes (the reason we're merging):

• pyOpenSSL>=24.3,<=25.3.0 → pyOpenSSL>=24.3,<=27.0.0
• cryptography>=42.0,<=46.1 → cryptography>=42.0,<=48.1

30 upstream commits (range origin/main..upstream/main), all low-risk:

• 5 Dependabot dep bumps (awscli, requests, urwid, tox, types-requests)
• Pyinstaller / github-actions group bumps
• 4 mitmweb UI bugfixes + Bootstrap removal (not consumed by Citus/mitmdump)
• TLS leaf cert SubjectKeyIdentifier fix (Copy issuer's SubjectKeyIdentifier into leaf AuthorityKeyIdentifier (RFC 5280 §4.2.1.2) mitmproxy/mitmproxy#8214, RFC 5280 §4.2.1.2)
• Reduced generated certificate validity (Reduce generated certificate validity mitmproxy/mitmproxy#8203)
• DoH blocklist update (Fix IP blocking and merge additional DoH blocklists mitmproxy/mitmproxy#8197)
• Misc utility fixes (strutils.is_xml CR handling, is_mostly_bin IndexError)
• mitmproxy 12.2.3 release tag + post-release housekeeping

What's preserved

Our citusdata-specific TCP-kill patches are unchanged:

• mitmproxy/proxy/layers/tcp.py — self.flow.live guard around SendData
• test/mitmproxy/proxy/layers/test_tcp.py — regression test test_kill_closes_connection_when_flow_not_live

Upstream touched neither of these files in the 30 merged commits, so the merge required no conflict resolution.

Verification

# pre-merge
$ grep -E "pyOpenSSL|cryptography" pyproject.toml | head -3
    "cryptography>=42.0,<=46.1",
    "pyOpenSSL>=24.3,<=25.3.0",

# post-merge
$ grep -E "pyOpenSSL|cryptography" pyproject.toml | head -3
    "cryptography>=42.0,<=48.1",  # relaxed upper bound here to get security fixes
    "pyOpenSSL>=24.3,<=27.0.0",

# TCP-kill patch still in place
$ grep -nC1 "self.flow.live" mitmproxy/proxy/layers/tcp.py
117-                yield TcpMessageHook(self.flow)
118:                if self.flow.live:
119-                    yield commands.SendData(send_to, tcp_message.content)

Follow-up (downstream)

Once this lands, the new merge commit SHA needs to be referenced in:

1. citusdata/citus@main:src/test/regress/Pipfile — bump the mitmproxy = {git=..., ref=...} ref + re-lock
2. citusdata/the-process:circleci/images/{pgupgradetester,failtester,citusupgradetester}/files/etc/requirements.txt — regenerate via pipenv requirements