citusdata · cituspackagingapp · Sep 10, 2026 · Sep 10, 2026
diff --git a/.github/workflows/dependency-security-sync.yml b/.github/workflows/dependency-security-sync.yml
@@ -4,6 +4,12 @@ on:
   schedule:
     - cron: '0 2 * * 0'
   workflow_dispatch:
+    inputs:
+      citus_ref:
+        description: Citus branch, tag, or commit to sync
+        required: false
+        default: main
+        type: string
 
 concurrency:
   group: dependency-security-sync
@@ -40,6 +46,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: citusdata/citus
+          ref: ${{ inputs.citus_ref || 'main' }}
           path: citus
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0
@@ -70,6 +77,9 @@ jobs:
         if: steps.alerts.outputs.count != '0'
         id: sync
         run: |
+          # Source history is not a manual edit to the bot-managed branches.
+          echo "CITUS_BASE_SHA=$(git -C citus rev-parse HEAD)" >> "$GITHUB_ENV"
+          echo "THE_PROCESS_BASE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
           python -m pip install --quiet packaging
           python .github/scripts/security_sync.py \
             --alerts alerts.json \
@@ -98,7 +108,7 @@ jobs:
             echo "No citus dependency changes to commit."
           else
             git commit -m "Automate Dependabot alert security dependency sync"
-            safe_push automation/dependency-security-sync origin/main
+            safe_push automation/dependency-security-sync "$CITUS_BASE_SHA"
           fi
 
           pr_number=$(gh pr list --repo citusdata/citus --head automation/dependency-security-sync --state open --json number --jq '.[0].number // empty')
@@ -160,7 +170,7 @@ jobs:
             echo "No the-process dependency changes to commit."
           else
             git commit -m "Automate security requirements sync from citus alerts"
-            safe_push automation/dependency-security-sync origin/master
+            safe_push automation/dependency-security-sync "$THE_PROCESS_BASE_SHA"
           fi
 
           # The machine-readable marker is consumed by the post-merge workflow to
@@ -203,7 +213,7 @@ jobs:
           else
             git add .github/workflows/build_and_test.yml
             git commit -m "Point CI at the-process dev image for synced requirements"
-            safe_push automation/dependency-security-sync origin/main
+            safe_push automation/dependency-security-sync "$CITUS_BASE_SHA"
           fi
 
       - name: Summary

diff --git a/circleci/images/citusupgradetester/files/etc/requirements.txt b/circleci/images/citusupgradetester/files/etc/requirements.txt
@@ -1,27 +1,27 @@
-# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8697
+# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8841
 # using `pipenv requirements > requirements.txt`, so as to avoid the
 # need for pipenv/pyenv in this image
 
 -i https://pypi.python.org/simple
 aioquic==1.2.0; python_version >= '3.8'
 argon2-cffi==25.1.0; python_version >= '3.8'
-argon2-cffi-bindings==25.1.0; python_version >= '3.9'
+argon2-cffi-bindings==26.1.0; python_version >= '3.10'
 asgiref==3.11.1; python_version >= '3.9'
 attrs==26.1.0; python_version >= '3.9'
 bcrypt==5.0.0; python_version >= '3.8'
 blinker==1.9.0; python_version >= '3.9'
 brotli==1.2.0
 certifi==2026.7.22; python_version >= '3.7'
-cffi==2.1.0; python_version >= '3.10'
-click==8.4.2; python_version >= '3.10'
+cffi==2.1.1; python_version >= '3.10'
+click==8.5.0; python_version >= '3.10'
 construct==2.10.70; python_version >= '3.6'
-cryptography==48.0.1; python_version >= '3.9' and python_full_version not in '3.9.0, 3.9.1'
+cryptography==50.0.0; python_version >= '3.9' and python_full_version not in '3.9.0, 3.9.1'
 docopt==0.6.2
 execnet==2.1.2; python_version >= '3.8'
-filelock==3.32.2; python_version >= '3.10'
+filelock==3.32.6; python_version >= '3.10'
 flask==3.1.3; python_version >= '3.9'
 h11==0.16.0; python_version >= '3.8'
-h2==4.3.0; python_version >= '3.9'
+h2==4.4.1; python_version >= '3.10'
 hpack==4.2.0; python_version >= '3.10'
 hyperframe==6.1.0; python_version >= '3.9'
 iniconfig==2.3.0; python_version >= '3.10'
@@ -30,19 +30,19 @@ jinja2==3.1.6; python_version >= '3.7'
 kaitaistruct==0.11; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'
 ldap3==2.9.1
 markupsafe==3.0.3; python_version >= '3.9'
-mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@321e6d203cf31e36d59ba8e4f9c6a3c4a5d6ddf0
+mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@a16444362cc0393ccf7329f50fc909b711729de7
 mitmproxy-linux==0.12.11; python_version >= '3.12'
 mitmproxy-rs==0.12.11; python_version >= '3.12'
 msgpack==1.2.1; python_version >= '3.10'
-packaging==26.2; python_version >= '3.8'
+packaging==26.3; python_version >= '3.9'
 pluggy==1.6.0; python_version >= '3.9'
-psycopg==3.3.4; python_version >= '3.10'
+psycopg==3.3.5; python_version >= '3.10'
 publicsuffix2==2.20191221
 pyasn1==0.6.4; python_version >= '3.8'
 pycparser==3.0; python_version >= '3.10'
-pygments==2.20.0; python_version >= '3.9'
+pygments==2.21.0; python_version >= '3.9'
 pylsqpack==0.3.24; python_version >= '3.10'
-pyopenssl==26.2.0; python_version >= '3.8'
+pyopenssl==26.4.0; python_version >= '3.9'
 pyparsing==3.3.2; python_version >= '3.9'
 pyperclip==1.9.0
 pytest==9.0.3; python_version >= '3.10'
@@ -54,10 +54,10 @@ pyyaml==6.0.3; python_version >= '3.8'
 ruamel.yaml==0.19.1; python_version >= '3.9'
 service-identity==26.1.0; python_version >= '3.8'
 sortedcontainers==2.4.0
-tornado==6.5.7; python_version >= '3.9'
+tornado==6.5.8; python_version >= '3.9'
 typing-extensions==4.14.0; python_version >= '3.9'
 urwid==4.0.0; python_full_version >= '3.9.0'
-wcwidth==0.8.2; python_version >= '3.8'
+wcwidth==0.8.3; python_version >= '3.8'
 werkzeug==3.1.6; python_version >= '3.9'
 wsproto==1.3.2; python_version >= '3.10'
 zstandard==0.25.0; python_version >= '3.9'
diff --git a/circleci/images/failtester/files/etc/requirements.txt b/circleci/images/failtester/files/etc/requirements.txt
@@ -1,27 +1,27 @@
-# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8697
+# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8841
 # using `pipenv requirements > requirements.txt`, so as to avoid the
 # need for pipenv/pyenv in this image
 
 -i https://pypi.python.org/simple
 aioquic==1.2.0; python_version >= '3.8'
 argon2-cffi==25.1.0; python_version >= '3.8'
-argon2-cffi-bindings==25.1.0; python_version >= '3.9'
+argon2-cffi-bindings==26.1.0; python_version >= '3.10'
 asgiref==3.11.1; python_version >= '3.9'
 attrs==26.1.0; python_version >= '3.9'
 bcrypt==5.0.0; python_version >= '3.8'
 blinker==1.9.0; python_version >= '3.9'
 brotli==1.2.0
 certifi==2026.7.22; python_version >= '3.7'
-cffi==2.1.0; python_version >= '3.10'
-click==8.4.2; python_version >= '3.10'
+cffi==2.1.1; python_version >= '3.10'
+click==8.5.0; python_version >= '3.10'
 construct==2.10.70; python_version >= '3.6'
-cryptography==48.0.1; python_version >= '3.9' and python_full_version not in '3.9.0, 3.9.1'
+cryptography==50.0.0; python_version >= '3.9' and python_full_version not in '3.9.0, 3.9.1'
 docopt==0.6.2
 execnet==2.1.2; python_version >= '3.8'
-filelock==3.32.2; python_version >= '3.10'
+filelock==3.32.6; python_version >= '3.10'
 flask==3.1.3; python_version >= '3.9'
 h11==0.16.0; python_version >= '3.8'
-h2==4.3.0; python_version >= '3.9'
+h2==4.4.1; python_version >= '3.10'
 hpack==4.2.0; python_version >= '3.10'
 hyperframe==6.1.0; python_version >= '3.9'
 iniconfig==2.3.0; python_version >= '3.10'
@@ -30,19 +30,19 @@ jinja2==3.1.6; python_version >= '3.7'
 kaitaistruct==0.11; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'
 ldap3==2.9.1
 markupsafe==3.0.3; python_version >= '3.9'
-mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@321e6d203cf31e36d59ba8e4f9c6a3c4a5d6ddf0
+mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@a16444362cc0393ccf7329f50fc909b711729de7
 mitmproxy-linux==0.12.11; python_version >= '3.12'
 mitmproxy-rs==0.12.11; python_version >= '3.12'
 msgpack==1.2.1; python_version >= '3.10'
-packaging==26.2; python_version >= '3.8'
+packaging==26.3; python_version >= '3.9'
 pluggy==1.6.0; python_version >= '3.9'
-psycopg==3.3.4; python_version >= '3.10'
+psycopg==3.3.5; python_version >= '3.10'
 publicsuffix2==2.20191221
 pyasn1==0.6.4; python_version >= '3.8'
 pycparser==3.0; python_version >= '3.10'
-pygments==2.20.0; python_version >= '3.9'
+pygments==2.21.0; python_version >= '3.9'
 pylsqpack==0.3.24; python_version >= '3.10'
-pyopenssl==26.2.0; python_version >= '3.8'
+pyopenssl==26.4.0; python_version >= '3.9'
 pyparsing==3.3.2; python_version >= '3.9'
 pyperclip==1.9.0
 pytest==9.0.3; python_version >= '3.10'
@@ -54,10 +54,10 @@ pyyaml==6.0.3; python_version >= '3.8'
 ruamel.yaml==0.19.1; python_version >= '3.9'
 service-identity==26.1.0; python_version >= '3.8'
 sortedcontainers==2.4.0
-tornado==6.5.7; python_version >= '3.9'
+tornado==6.5.8; python_version >= '3.9'
 typing-extensions==4.14.0; python_version >= '3.9'
 urwid==4.0.0; python_full_version >= '3.9.0'
-wcwidth==0.8.2; python_version >= '3.8'
+wcwidth==0.8.3; python_version >= '3.8'
 werkzeug==3.1.6; python_version >= '3.9'
 wsproto==1.3.2; python_version >= '3.10'
 zstandard==0.25.0; python_version >= '3.9'
diff --git a/circleci/images/pgupgradetester/files/etc/requirements.txt b/circleci/images/pgupgradetester/files/etc/requirements.txt
@@ -1,27 +1,27 @@
-# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8697
+# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8841
 # using `pipenv requirements > requirements.txt`, so as to avoid the
 # need for pipenv/pyenv in this image
 
 -i https://pypi.python.org/simple
 aioquic==1.2.0; python_version >= '3.8'
 argon2-cffi==25.1.0; python_version >= '3.8'
-argon2-cffi-bindings==25.1.0; python_version >= '3.9'
+argon2-cffi-bindings==26.1.0; python_version >= '3.10'
 asgiref==3.11.1; python_version >= '3.9'
 attrs==26.1.0; python_version >= '3.9'
 bcrypt==5.0.0; python_version >= '3.8'
 blinker==1.9.0; python_version >= '3.9'
 brotli==1.2.0
 certifi==2026.7.22; python_version >= '3.7'
-cffi==2.1.0; python_version >= '3.10'
-click==8.4.2; python_version >= '3.10'
+cffi==2.1.1; python_version >= '3.10'
+click==8.5.0; python_version >= '3.10'
 construct==2.10.70; python_version >= '3.6'
-cryptography==48.0.1; python_version >= '3.9' and python_full_version not in '3.9.0, 3.9.1'
+cryptography==50.0.0; python_version >= '3.9' and python_full_version not in '3.9.0, 3.9.1'
 docopt==0.6.2
 execnet==2.1.2; python_version >= '3.8'
-filelock==3.32.2; python_version >= '3.10'
+filelock==3.32.6; python_version >= '3.10'
 flask==3.1.3; python_version >= '3.9'
 h11==0.16.0; python_version >= '3.8'
-h2==4.3.0; python_version >= '3.9'
+h2==4.4.1; python_version >= '3.10'
 hpack==4.2.0; python_version >= '3.10'
 hyperframe==6.1.0; python_version >= '3.9'
 iniconfig==2.3.0; python_version >= '3.10'
@@ -30,19 +30,19 @@ jinja2==3.1.6; python_version >= '3.7'
 kaitaistruct==0.11; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'
 ldap3==2.9.1
 markupsafe==3.0.3; python_version >= '3.9'
-mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@321e6d203cf31e36d59ba8e4f9c6a3c4a5d6ddf0
+mitmproxy @ git+https://github.com/citusdata/mitmproxy.git@a16444362cc0393ccf7329f50fc909b711729de7
 mitmproxy-linux==0.12.11; python_version >= '3.12'
 mitmproxy-rs==0.12.11; python_version >= '3.12'
 msgpack==1.2.1; python_version >= '3.10'
-packaging==26.2; python_version >= '3.8'
+packaging==26.3; python_version >= '3.9'
 pluggy==1.6.0; python_version >= '3.9'
-psycopg==3.3.4; python_version >= '3.10'
+psycopg==3.3.5; python_version >= '3.10'
 publicsuffix2==2.20191221
 pyasn1==0.6.4; python_version >= '3.8'
 pycparser==3.0; python_version >= '3.10'
-pygments==2.20.0; python_version >= '3.9'
+pygments==2.21.0; python_version >= '3.9'
 pylsqpack==0.3.24; python_version >= '3.10'
-pyopenssl==26.2.0; python_version >= '3.8'
+pyopenssl==26.4.0; python_version >= '3.9'
 pyparsing==3.3.2; python_version >= '3.9'
 pyperclip==1.9.0
 pytest==9.0.3; python_version >= '3.10'
@@ -54,10 +54,10 @@ pyyaml==6.0.3; python_version >= '3.8'
 ruamel.yaml==0.19.1; python_version >= '3.9'
 service-identity==26.1.0; python_version >= '3.8'
 sortedcontainers==2.4.0
-tornado==6.5.7; python_version >= '3.9'
+tornado==6.5.8; python_version >= '3.9'
 typing-extensions==4.14.0; python_version >= '3.9'
 urwid==4.0.0; python_full_version >= '3.9.0'
-wcwidth==0.8.2; python_version >= '3.8'
+wcwidth==0.8.3; python_version >= '3.8'
 werkzeug==3.1.6; python_version >= '3.9'
 wsproto==1.3.2; python_version >= '3.10'
 zstandard==0.25.0; python_version >= '3.9'
diff --git a/circleci/images/stylechecker/files/etc/requirements.txt b/circleci/images/stylechecker/files/etc/requirements.txt
@@ -1,19 +1,19 @@
-# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8697
+# generated from Citus's Pipfile.lock (in src/test/regress) as of citusdata/citus#8841
 # using `pipenv requirements --dev-only > requirements.txt`, so as to avoid the
 # need for pipenv/pyenv in this image
 
 -i https://pypi.python.org/simple
 attrs==26.1.0; python_version >= '3.9'
 black==26.3.1; python_version >= '3.10'
-click==8.4.2; python_version >= '3.10'
+click==8.5.0; python_version >= '3.10'
 flake8==7.3.0; python_version >= '3.9'
-flake8-bugbear==25.11.29; python_version >= '3.10'
-isort==8.0.1; python_full_version >= '3.10.0'
+flake8-bugbear==26.9.9; python_version >= '3.10'
+isort==9.0.1; python_full_version >= '3.10.0'
 mccabe==0.7.0; python_version >= '3.6'
 mypy-extensions==1.1.0; python_version >= '3.8'
-packaging==26.2; python_version >= '3.8'
+packaging==26.3; python_version >= '3.9'
 pathspec==1.1.1; python_version >= '3.9'
-platformdirs==4.11.0; python_version >= '3.10'
+platformdirs==4.11.8; python_version >= '3.10'
 pycodestyle==2.14.0; python_version >= '3.9'
 pyflakes==3.4.0; python_version >= '3.9'
 pytokens==0.4.1; python_version >= '3.8'