Following the recent gerrit breach, I manually audited all recent changes to the openstack/requirements repository, and could not find suspicious activity. Cheers, -- Thierry Carrez (ttx)