pip>=26.2.2 and certifi>=2026.10.19 (#1472)

* pip>=26.2.2, certifi>=2026.10.19

* slightly change syntax

* add quotes around it

* add comment

.github/workflows/package-macos.yml

@@ -38,7 +38,9 @@ jobs:
           cache: 'pip'
       - name: Install python dependencies
         run: |
-          python -m pip install --upgrade pip pyinstaller certifi
+          python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+          python -m pip install 'certifi>=2026.10.19'
+          python -m pip install --upgrade pip pyinstaller
           pip install -r requirements.txt
       - name: Install the Apple certificate and provisioning profile
 #        TODO signing

.github/workflows/package-osx-legacy.yml

@@ -40,7 +40,9 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 --version
-          pip3 install --upgrade pip pyinstaller certifi
+          python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+          python -m pip install 'certifi>=2026.10.19'
+          pip3 install --upgrade pip pyinstaller
           pip3 install --upgrade -r requirements-osx-legacy.txt
           ./gen_ui_files.sh
       - uses: actions/setup-node@v7

.github/workflows/package-windows.yml

@@ -49,9 +49,11 @@ jobs:
         env:
           PYINSTALLER_COMPILE_BOOTLOADER: 1
         run: |
+          python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+          python -m pip install 'certifi>=2026.10.19'
           python -m pip install --upgrade pip
           pip install -r ${{ matrix.requirements }}
-          pip install certifi pyinstaller --no-binary pyinstaller
+          pip install pyinstaller --no-binary pyinstaller
       - name: build binary
         run: |
           python setup.py ${{ matrix.command }}

.github/workflows/package-windows7.yml

@@ -36,10 +36,12 @@ jobs:
       - name: Install dependencies
         env:
           PYINSTALLER_COMPILE_BOOTLOADER: 1
+        # should be safe since final Python 3.8 pip came out before eMudhra certificate was issued
         run: |
           python -m pip install --upgrade pip
+          python -m pip install 'certifi>=2026.10.19'
           pip install -r requirements-win7.txt
-          pip install certifi pyinstaller --no-binary pyinstaller
+          pip install pyinstaller --no-binary pyinstaller
           .\gen_ui_files.bat
       - name: build binary
         run: |