From d06d6951b401d4b02c0741e6e5997c2f969d2cc2 Mon Sep 17 00:00:00 2001
From: raymondginger <raymondginger2018@gmail.com>
Date: Sun, 23 Aug 2026 14:12:56 +0800
Subject: [PATCH] fix(security): bump sidecar pip 26.1.2 -> 26.2
 (PYSEC-2026-3721)

Security CI's 'Audit locked App Server environment' step fails on every
branch because the sidecar lock pins pip==26.1.2, which PYSEC-2026-3721
(healchecks pip < 26.2) now flags. pip publishes no wheels-only constraint
here, so bump the universal lock entry to the fixed 26.2 release.
---
 desktop/sidecar-requirements.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/desktop/sidecar-requirements.lock b/desktop/sidecar-requirements.lock
index 8e5e0ef9..5e0caa59 100644
--- a/desktop/sidecar-requirements.lock
+++ b/desktop/sidecar-requirements.lock
@@ -105,7 +105,7 @@ packaging==26.2
     #   pyinstaller-hooks-contrib
 pefile==2024.8.26 ; sys_platform == 'win32'
     # via pyinstaller
-pip==26.1.2
+pip==26.2
     # via -r sidecar-requirements.in
 prompt-toolkit==3.0.52
     # via -r sidecar-requirements.in