Bump certbot from 4.1.1 to 5.6.0

[dependabot]

Bumps certbot from 4.1.1 to 5.6.0.

Release notes

Sourced from certbot's releases.

Certbot 5.6.0

Changed

• certbot now requires version 1.7+ of the library distro and certbot-dns-cloudflare requires 4.0+ of the Cloudflare Python library. (#10587)

Fixed

• The certbot-dns-ovh snap and docker image now properly delete any created TXT records after the challenge is completed by requiring dns-lexicon 3.25.1 which contains the fix. (#10492)
• Our Docker images have been updated to use Python 3.14 and Alpine Linux 3.23. (#10619)

Certbot 5.5.0

Changed

• Moved nearly all code for the certbot-nginx and certbot-apache plugins into private modules in the certbot package which now offers "apache" and "nginx" extras. Users should notice no major changes. certbot-apache and certbot-nginx will continue to exist as simple packages that depend on certbot and also help register the plugin with certbot so it knows the functionality is available. Unit tests for these plugins are now also part of the certbot package. (#10484)
• The certbot.ocsp module has been deprecated and will be removed in the next major release. This is not a change to Certbot's OCSP functionality. The code is just being removed from Certbot's public API. (#10584)

Certbot 5.4.0

Added

• The webroot plugin now supports IP address issuance. (#10543)

Changed

• certbot-nginx now requires pyparsing>=3.0.0. (#10560)

Certbot 5.3.1

Fixed

• We rebuilt our snaps to include updated versions our dependencies. (#10569)

Certbot 5.3.0

Added

• A new command line flag, --ip-address, has been added. This requests certificates with IP address SANs when using the standalone or manual plugin. Note that for Let's Encrypt's implementation of IP address certificates, you'll also need to pass --preferred-profile shortlived. (#10465)

Changed

• Deploy directory hooks are now also run when using certbot certonly or certbot run to get a new cert. This change was made for pre and post directory hooks in our 3.2.0 release so this change unifies Certbot's behavior here. (#9978)
• A few largely unused functions/types have been deprecated in our effort to remove our pyOpenSSL dependency: * Deprecated: certbot.crypto_util.get_sans_from_cert * Deprecated: certbot.crypto_util.get_names_from_cert * Deprecated: certbot.crypto_util.get_names_from_req * Deprecated: certbot.crypto_util.import_csr_file (and replaced by certbot.crypto_util.read_csr_file) * Deprecated: acme.crypto_util.Format (#10433)
• achallenges.KeyAuthorizationAnnotatedChallenge, achallenges.DNS, and achallenges.Other have a new field identifier, of type acme.messages.Identifier. This should be used in place of the domain field, which is now deprecated both as an attribute and during object creation. (#10491)
• Authenticator.get_chall_pref's argument has been renamed from domain to identifier, and can now receive string-formatted IP addresses in addition to domain names. (#10495)
• san.DNSName now calls util.enforce_domain_sanity to reduce code duplication (#10519)

Fixed

... (truncated)

Commits

• 03b5cf3 Release 5.6.0
• cf0e0f6 Update changelog for 5.6.0 release
• 9339d23 Migrate extended/full/test-* tests from azure pipelines to github actions (...
• 208ff18 remove readthedocs requirements files (#10639)
• c8ebcb4 Migrate certbot-dns-cloudflare to cloudflare 4.x SDK (#10587)
• 9ec4105 Migrate PR tests from azure pipelines to github actions (#10622)
• 6114144 Merge pull request #10630 from certbot/lexicon-repin
• 3a5c92c update base docker image (#10620)
• 0cc0844 Release certbot 5.5.0 (#10616)
• fc91823 Bump version to 5.6.0
• Additional commits viewable in compare view

[cassi-volkova]

This update is included in aggregate dependency PR #28.

CASSI completed the source/changelog review and final release-backed validation. The aggregate now resolves published gcl_iam 1.3.2, GCL SDK 3.0.8, Certbot 5.6.0, Mock 5.2.0, and Cryptography 49.0.0 without Git overrides. The Python 3.10–3.14 local matrix, GitHub CI, package builds, Certbot interface, RSA/CSR, IAM, and DNS client compatibility checks pass.

The final report is published in #28, which is ready for review.