Catch staging up with master [staging]

compose/local/django/Dockerfile

@@ -13,15 +13,16 @@ RUN apt-get -qq -y update && \
   # LibreOffice dependencies
   libnss3-dev libcurl4-openssl-dev libxslt1-dev libpixman-1-0 libxcb-render0-dev \
   # Utilities
-  curl git
+  curl git ca-certificates
+
 
 # set up makecert root CA
 RUN curl http://localhost/rootCA.pem > /usr/local/share/ca-certificates/rootCA.crt && update-ca-certificates
 
 # Requirements are installed here to ensure they will be cached.
 COPY ./requirements /requirements
 
-RUN pip install --upgrade "pip>=26,<27" && pip install -r /requirements/local.txt
+RUN python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" && pip install -r /requirements/local.txt
 
 COPY ./compose/production/django/entrypoint /entrypoint
 RUN sed -i 's/\r//' /entrypoint && chmod +x /entrypoint
@@ -46,4 +47,4 @@ WORKDIR /app
 
 ENV LD_LIBRARY_PATH /app/documentcloud/documents/processing/ocr/tesseract
 
-ENTRYPOINT ["/entrypoint"]
+ENTRYPOINT ["/entrypoint"]

compose/production/django/Dockerfile

@@ -7,14 +7,16 @@ RUN apt-get -qq -y update && apt-get -qq -y install \
   # Pillow dependencies
   libjpeg62-turbo zlib1g-dev libfreetype6-dev liblcms2-dev libopenjp2-7-dev libtiff6 tk-dev tcl-dev \
   # CFFI dependencies
-  libffi-dev python3-cffi
+  libffi-dev python3-cffi \
+  # System CA store; pulls Debian's fixed ca-certificates
+  ca-certificates
 
 RUN groupadd -r django \
     && useradd -r -g django django
 
 # Requirements are installed here to ensure they will be cached. 
 COPY ./requirements /requirements
-RUN pip install --upgrade "pip>=26,<27" && pip install --no-cache-dir -r /requirements/production.txt \
+RUN python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" && pip install --no-cache-dir -r /requirements/production.txt \
     && rm -rf /requirements
 
 COPY ./compose/production/django/entrypoint /entrypoint

documentcloud/documents/migrations/0057_document_documents_org_id_idx.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.2.15 on 2026-10-16 20:12
+
+from django.contrib.postgres.operations import AddIndexConcurrently
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    atomic = False
+    dependencies = [
+        ("documents", "0056_alter_document_language_alter_document_status_and_more"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        migrations.swappable_dependency(settings.SQUARELET_ORGANIZATION_MODEL),
+    ]
+
+    operations = [
+        AddIndexConcurrently(
+            model_name="document",
+            index=models.Index(
+                fields=["organization", "id"], name="documents_org_id_idx"
+            ),
+        ),
+    ]

documentcloud/documents/models/document.py

@@ -268,6 +268,10 @@ class Meta:
                 condition=Q(access=Access.public),
                 name="documents_user_public_idx",
             ),
+            models.Index(
+                fields=["organization", "id"],
+                name="documents_org_id_idx",
+            ),
         ]
 
     def __str__(self):

requirements/base.txt

@@ -53,7 +53,7 @@ celery==5.4.0
     # via
     #   -r requirements/base.in
     #   squarelet-auth
-certifi==2026.2.25
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via
@@ -274,7 +274,6 @@ luqum==0.8.1
     # via -r requirements/base.in
 lxml==6.1.1
     # via
-    #   -r requirements/base.in
     #   pikepdf
     #   premailer
 markdown==3.8.1

requirements/local.in

@@ -4,7 +4,7 @@ Werkzeug
 ipdb
 Sphinx
 psycopg2 --no-binary psycopg2
-pip-tools
+pip-tools>=7.6.1
 pip-audit
 
 # Testing

requirements/local.txt

@@ -98,7 +98,7 @@ celery==5.4.0
     # via
     #   -r requirements/base.txt
     #   squarelet-auth
-certifi==2026.2.25
+certifi==2026.10.19
     # via
     #   -r requirements/base.txt
     #   requests
@@ -533,7 +533,7 @@ pip-audit==2.7.3
     # via -r requirements/local.in
 pip-requirements-parser==32.0.1
     # via pip-audit
-pip-tools==7.5.3
+pip-tools==7.6.1
     # via -r requirements/local.in
 platformdirs==2.5.2
     # via

requirements/production.txt

@@ -83,7 +83,7 @@ celery==5.4.0
     #   -r requirements/base.txt
     #   django-celery-email
     #   squarelet-auth
-certifi==2026.2.25
+certifi==2026.10.19
     # via
     #   -r requirements/base.txt
     #   requests