From e936b047467d4a16e4b529af4b45e11e8bc136d2 Mon Sep 17 00:00:00 2001
From: Tyler Mathis <35553152+tsmathis@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:10:45 -0700
Subject: [PATCH] bump pip for CA cert security incident

---
 .github/workflows/upgrade-dependencies.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/upgrade-dependencies.yml b/.github/workflows/upgrade-dependencies.yml
index 7d6ea69b..3902f470 100644
--- a/.github/workflows/upgrade-dependencies.yml
+++ b/.github/workflows/upgrade-dependencies.yml
@@ -23,7 +23,9 @@ jobs:
       - name: Upgrade Python dependencies
         shell: bash
         run: |
-          python${{ matrix.python-version }} -m pip install --upgrade "pip<25.3" pip-tools wheel cython setuptools
+          # emSign bootstrap (2026-10): install hash-pinned pip first, then everything else
+          python${{ matrix.python-version }} -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+          python${{ matrix.python-version }} -m pip install --upgrade pip-tools wheel cython setuptools
           python${{ matrix.python-version }} -m pip install `grep numpy== requirements/${{ matrix.os }}_py${{ matrix.python-version }}_extras.txt`
           python${{ matrix.python-version }} -m piptools compile -q --upgrade -o requirements/${{ matrix.os }}_py${{ matrix.python-version }}.txt pyproject.toml
           python${{ matrix.python-version }} -m piptools compile -q --upgrade --all-extras -o requirements/${{ matrix.os }}_py${{ matrix.python-version }}_extras.txt pyproject.toml