DESCRIPTION: Update mitmproxy fork to lift pyOpenSSL cap; re-lock to 26.2.0 (closes CVE-2026-27459, CVE-2026-27448)

Summary

Bumps the mitmproxy git ref in both Pipfiles from the pinned commit SHA 70bad9a3c098... to track citusdata/mitmproxy@main. After citusdata/mitmproxy#4 (merge of upstream mitmproxy/mitmproxy@main), our fork's main caps pyOpenSSL<=27.0.0 (was <=25.3.0), unblocking the lockfile from resolving past pyOpenSSL 25.3.0.

Re-locking both Pipfiles via pipenv lock resolves pyopenssl to 26.2.0, closing all four currently-open Dependabot security alerts:

Pipfile changes

Single line per file, in both:

• src/test/regress/Pipfile
• .devcontainer/src/test/regress/Pipfile

-mitmproxy = {git = "https://github.com/citusdata/mitmproxy.git", ref = "70bad9a3c098f605e5f8b25553e5db5334018ff1"}
+mitmproxy = {git = "https://github.com/citusdata/mitmproxy.git", ref = "main"}

The ref="main" form is supported by pipenv for git deps; the resolved commit SHA (df5879516a57ea780e1cc88edaf2051e1d32915f — the merge commit of mitmproxy#4) is pinned in Pipfile.lock, preserving reproducibility.

Lockfile-level changes (re-lock side-effects, no Pipfile pin changes)

Per scope direction, no other direct deps were bumped — only the security-driven mitmproxy ref change. Other transitive movements above are natural consequences of pipenv lock --clear against unchanged version constraints.

Validation

$ cd src/test/regress
$ pipenv sync
Installing dependencies from Pipfile.lock (416d8f)...
All dependencies are now up-to-date!

$ pipenv run pip show mitmproxy pyopenssl | grep -E "^Name:|^Version:"
Name: mitmproxy
Version: 13.0.0.dev0
Name: pyOpenSSL
Version: 26.2.0

Both src/test/regress/Pipfile.lock and .devcontainer/src/test/regress/Pipfile.lock are byte-identical, per the convention established in #8488 and #8547.

Notes

• Lockfiles regenerated with pipenv lock --clear (pipenv 2025.0.3, Python 3.12.12).
• Currently-open Dependabot dependency-update bot PRs (Bump pyasn1 from 0.6.2 to 0.6.3 in /src/test/regress #8525, Bump pyasn1 from 0.6.2 to 0.6.3 in /.devcontainer/src/test/regress #8526 pyasn1; Bump werkzeug from 3.1.5 to 3.1.6 in /.devcontainer/src/test/regress #8489 werkzeug; Bump black from 24.10.0 to 26.3.1 in /.devcontainer/src/test/regress #8510, Bump black from 24.3.0 to 26.3.1 in /.devcontainer #8511 black) target versions that the existing lockfile already satisfies — they will auto-close on next Dependabot scan without further action.
• Follow-up PR on citusdata/the-process will regenerate the three circleci/images/*/files/etc/requirements.txt files (which are generated from this Pipfile.lock via pipenv requirements) once this lands.

Closes #123
Closes #124
Closes #125
Closes #126