[jrmccluskey]

Move the pinned pip to 26.2.2, the first version with the emSign root CA certificate removed (https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576). Also recommends 26.2.2 as the new minimum pip version when installing.

DO NOT MERGE

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 79.91%. Comparing base (2213e54) to head (d4dc0ff).
⚠️ Report is 45 commits behind head on master.

Files with missing lines	Patch %	Lines
sdks/python/setup.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #40847       +/-   ##
===========================================
+ Coverage        0   79.91%   +79.91%     
===========================================
  Files           0      493      +493     
  Lines           0    83479    +83479     
===========================================
+ Hits            0    66710    +66710     
- Misses          0    16769    +16769     

Flag	Coverage Δ
python	79.91% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Checks are failing. Will not request review until checks are succeeding. If you'd like to override that behavior, comment assign set of reviewers

[github-actions]

📋 Review Summary

This PR updates the pinned pip version in BeamModulePlugin.groovy (setupVirtualenv) from 25.0.1 to 26.2.2 and bumps RECOMMENDED_MIN_PIP_VERSION in sdks/python/setup.py to 26.2.2 in response to the eMudhra / emSign root CA certificate removal in certifi / pip 26.2.2. The changes are clean, minimal, and all triggered pre-commit and post-commit Python dependency test suites are passing.

🔍 General Feedback

• The pip==26.2.2 pin in BeamModulePlugin.groovy and RECOMMENDED_MIN_PIP_VERSION in sdks/python/setup.py align with the recent container requirements update in #40696.
• Follow-up note: sdks/python/tox.ini still pins pip==25.0.1 in [testenv:py311-ml] (line 97) and [testenv:py311-transformers-{441,457,latest}] (line 369); consider updating those environments to pip==26.2.2 as well if the resolver hang from pip 25.1 is no longer present.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[github-actions]

Assigning reviewers:

R: @claudevdm for label python.
Backup reviewer: shunping (if the main reviewer is unresponsive, you can escalate to them by tagging their username)

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).