Upgrade pip to resolve CVE-2026-8643

[blaipr]

SUMMARY

pip is pinned at 26.1, which is affected by CVE-2026-8643 (PYSEC-2026-196), fixed in 26.1.2. The pin was originally added to resolve an earlier pip advisory (CVE-2026-3219); this bumps it to pick up the newer fix while keeping that one.

Changes, mirroring the existing pip-pin pattern (PR #321):

• requirements/requirements.in: pip==26.1 # see CVE-2026-3219 → pip==26.1.2 # see CVE-2026-8643
• requirements/updater.sh: compile-venv bootstrap pip==26.1 → pip==26.1.2
• Makefile: VENV_BOOTSTRAP pip==26.1 → pip==26.1.2
• requirements/requirements.txt: regenerated with requirements/updater.sh run — the only package-level change is pip==26.1 → pip==26.1.2

Found via pip-audit against requirements.txt; it was the only vulnerability reported in the Python production requirements (dev requirements and the shipped UI bundle audit clean).

ISSUE TYPE

• Bug, Docs Fix or other nominal change

COMPONENT NAME

• API

ASCENDER VERSION

awx: 25.4.1.dev21+g761ea17.d20260613

ADDITIONAL INFORMATION

requirements.txt regenerated inside the awx container per the documented process.

# inside tools_awx_1
py.test awx/main/tests/functional/test_licenses.py   # 1 passed
pip-audit -r requirements/requirements.txt           # pip 26.1 was the only finding; resolved by 26.1.2

[Copilot]

Pull request overview

Updates the pinned pip version across Ascender’s dependency inputs and bootstrap tooling to remediate CVE-2026-8643 while keeping the existing “pinned pip” pattern consistent with prior security-driven pins.

Changes:

• Bump pip pin from 26.1 to 26.1.2 in the source requirements input (requirements.in).
• Update the requirements compilation bootstrap (requirements/updater.sh) and venv bootstrap (Makefile) to install pip==26.1.2.
• Regenerate requirements/requirements.txt reflecting only the pip version change.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
requirements/updater.sh	Updates the compile-venv bootstrap install to pip==26.1.2.
requirements/requirements.txt	Regenerated lockfile showing pip==26.1.2 under the “unsafe” section.
requirements/requirements.in	Updates the pinned pip version and CVE reference comment.
Makefile	Updates VENV_BOOTSTRAP to pip==26.1.2 for consistent environment bootstrapping.