[vgulati-apphelix]

Description

Security fix for the eMudhra / emSign CA incident (GHSA-6q48-6c7w-9gw2). pip vendors its own certifi, so hosts need pip 26.2.2 as well as certifi 2026.10.19.

xqueue, xqueue-watcher, edx-analytics-dashboard and edx-analytics-data-api are built as AMIs by these roles, not from Docker images, so the pip fix in the app repos and in edx/public-dockerfiles#234 never reached them. Their venvs kept an old pip:

Play	Venv pip came from	Before
xqueue	python3.12 -m venv (ensurepip)	24.0
xqwatcher	virtualenv 20.27.0	24.2
insights	virtualenv 20.27.0 (via edx_service)	24.2
analyticsapi	edx_django_service "Pin pip" step (COMMON_PIP_VERSION)	24.0

Each role now installs the app repo's own requirements/pip.txt (pip==26.2.2 on all four repos' default branches) into the venv before the app requirements:

• xqueue, xqwatcher: new "Install pinned pip" task, with xqueue_pip_requirements_file / xqwatcher_pip_requirements_file defaults.
• insights: pip.txt added first in insights_requirements.
• edx_django_service: the "Pin pip" step uses a new edx_django_service_pip_install_args, defaulting to the existing pip=={{ COMMON_PIP_VERSION }}, so other services are unchanged. analytics_api overrides it with -r <code_dir>/requirements/pip.txt.

COMMON_PIP_VERSION (system pip) is not changed: pip 26.2.2 needs Python 3.10+, and plays still on Python 3.8 would break.

Supporting information

• Jira: LP-1401 (private)
• Upstream tracking: openedx/public-engineering#574

Testing

• ansible-playbook --syntax-check (ansible 2.10.7): xqueue.yml, xqwatcher.yml, insights.yml, analyticsapi.yml pass.
• Simulated each venv in containers with the repos' real pip.txt: xqueue (python3.12 -m venv) 25.0.1 → 26.2.2; xqwatcher / insights (virtualenv 20.27.0) 24.2 → 26.2.2; analyticsapi (py3.11, pinned 24.0) 24.0 → 26.2.2.
• App code is checked out before these tasks (edx_service → git_clone in each role's meta), so requirements/pip.txt exists when they run. No overrides of the touched variables in edx-internal.
• Not yet run as a real AMI build. After merge: run the xqueue, xqwatcher, insights and analytics-api pipelines, then check <venv>/bin/pip --version is 26.2.2 on a new host.

---

Make sure that the following steps are done before merging:

• Have a Site Reliability Engineer review the PR if you don't own all of the services impacted.
• If you are adding any new default values that need to be overridden when this change goes live, update internal repos and add an entry to the top of the CHANGELOG.
• Performed the appropriate testing.

🤖 Generated with Claude Code

[abhalsod-sonata]

LGTM