Remove pip pin from App Engine requirements

[glenn-jocher]

Summary

• remove the App Engine runtime requirement pin for pip==26.0
• leave the actual app runtime dependencies unchanged
• resolves the Dependabot alert for GHSA-58qw-9mgm-455v / CVE-2026-3219, which currently has no patched pip release

Validation

• rg -n "^pip([<>=!~ ]|$)|pip==" -g "*requirements*.txt" -g "pyproject.toml" -g "setup.cfg" -g "setup.py"
• git diff --check
• /tmp/yolov5-pip-alert-venv/bin/python -m pip install --dry-run -r utils/google_app_engine/additional_requirements.txt

🛠️ PR Summary

_{Made with ❤️ by Ultralytics Actions}

🌟 Summary

🧹 This PR removes the pinned pip==26.0 dependency from the Google App Engine supplemental requirements to avoid unnecessarily forcing a specific pip version during deployment.

📊 Key Changes

• Removed pip==26.0 from utils/google_app_engine/additional_requirements.txt
• Kept the existing Google App Engine-related packages unchanged:
  • Flask==3.1.3
  • gunicorn==23.0.0
  • werkzeug>=3.0.1

🎯 Purpose & Impact

• Reduces the chance of deployment issues caused by pinning pip as an application dependency ⚙️
• Keeps the requirements file focused on runtime packages actually needed by the app 📦
• Improves compatibility with Google App Engine environments, which typically manage pip separately ☁️
• Makes dependency management a bit cleaner and less brittle for users deploying YOLOv5 services 🚀

[UltralyticsAssistant]

👋 Hello @glenn-jocher, thank you for submitting a ultralytics/yolov5 🚀 PR! This is an automated message to help with review, and an engineer will assist you shortly.

To ensure a seamless integration of your work, please review the following checklist:
-✅ Define a Purpose: Clearly explain the purpose of your fix or feature in your PR description, and link to any relevant issues. Ensure your commit messages are clear, concise, and adhere to the project's conventions.
-✅ Synchronize with Source: Confirm your PR is synchronized with the ultralytics/yolov5 main branch. If it's behind, update it by clicking the 'Update branch' button or by running git pull and git merge main locally.
-✅ Ensure CI Checks Pass: Verify all Ultralytics Continuous Integration (CI) checks are passing. If any checks fail, please address the issues.
-✅ Update Documentation: Update the relevant documentation for any new or modified features.
-✅ Add Tests: If applicable, include or update tests to cover your changes, and confirm that all tests are passing.
-✅ Sign the CLA: Please ensure you have signed our Contributor License Agreement if this is your first Ultralytics PR by writing "I have read the CLA Document and I sign the CLA" in a new message.
-✅ Minimize Changes: Limit your changes to the minimum necessary for your bug fix or feature addition. "It is not daily increase but daily decrease, hack away the unessential. The closer to the source, the less wastage there is." — Bruce Lee

For more guidance, please refer to our Contributing Guide. Don't hesitate to leave a comment if you have any questions. Thank you for contributing to Ultralytics! 🚀

[UltralyticsAssistant]

🔍 PR Review

_{Made with ❤️ by Ultralytics Actions}

Clean PR. Removing the explicit pip pin from the App Engine supplemental requirements is a narrow, low-risk change, and I don't see any concrete bug, compatibility, or maintainability issue in the provided diff.

[UltralyticsAssistant]

🎉 Merged — thanks, @glenn-jocher!

“Perfection is achieved, not when there is nothing more to add, but when there is nothing left to take away.” — Antoine de Saint-Exupéry

This cleanup is a great example of that idea in practice: removing the pinned pip==26.0 keeps the Google App Engine requirements focused on true runtime needs, reduces deployment brittleness, and improves compatibility for YOLOv5 users. Small dependency refinements like this make a real difference in reliability and maintainability. 🙌