--- a/ansible/roles/autoland/files/requirements.txt
+++ b/ansible/roles/autoland/files/requirements.txt
@@ -35,18 +35,18 @@ Jinja2==2.8 \
     --hash=sha256:1cc03ef32b64be19e0a5b54578dd790906a34943fe9102cfdae0d4495bd536b4
 
 kombu==3.0.37 \
     --hash=sha256:7ceab743e3e974f3e5736082e8cc514c009e254e646d6167342e0e192aee81a6
 
 MarkupSafe==0.23 \
     --hash=sha256:a4ec1aff59b95a14b45eb2e23761a0179e98319da5a7eb76b56ea8cdc7b871c3
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 mozillapulse==1.2.2 \
     --hash=sha256:750ce5a2b4bd225bd00b339e1ac533c16b187c0804695bb3d878c699ee2b3228
 
 ndg_httpsclient==0.4.2 \
     --hash=sha256:580987ef194334c50389e0d7de885fccf15605c13c6eecaabd8d6c43768eb8ac
 
 psycopg2==2.6.1 \

--- a/ansible/roles/docker-hg-web/files/requirements-mozbuild.txt
+++ b/ansible/roles/docker-hg-web/files/requirements-mozbuild.txt
@@ -1,11 +1,11 @@
 jsmin==2.1.2 \
     --hash=sha256:5e710e9db14f210dfd55ebec43bca5c812d34c5b6179dbcba2e61d9f965bf4e1
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 mozbuild==0.2 \
     --hash=sha256:24227608fc3c735fbb5c629d0540a600368c1d5e57013dd39272a0a5c9cccb13
 
 mozfile==1.2 \
     --hash=sha256:d3b00f336c6a89449bd78dd3ae65d74eb98497438d1ccfec07af0a736d20e957

--- a/ansible/roles/hg-reviewboard/files/requirements-hgweb.txt
+++ b/ansible/roles/hg-reviewboard/files/requirements-hgweb.txt
@@ -1,15 +1,15 @@
 # We need RBTools in the hgweb venv because we support pushing via HTTP.
 # This is different from hg.mozilla.org's configuration.
 
 --find-links https://downloads.reviewboard.org/releases/RBTools/0.7/
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 mod-wsgi==4.5.14 \
     --hash=sha256:8e6d0ccdea6872b71da2ba0fe5d46ca38a6219becc521dcdc4516992c9fe3247
 
 Pygments==2.1.1 \
     --hash=sha256:05aee25c433d6155defbfbcb6c2e2b0ebf29d28138604867b62a304bd6bbb41d
 
 python-ldap==2.4.20 \

--- a/ansible/roles/hg-ssh-server/files/requirements-pash.txt
+++ b/ansible/roles/hg-ssh-server/files/requirements-pash.txt
@@ -1,18 +1,18 @@
 --find-links https://downloads.reviewboard.org/releases/RBTools/0.7/
 
 # Kafka is in this virtualenv to support replication on the hg leader server.
 # It isn't needed on a standalone hg server. But installing it doesn't really
 # hurt.
 kafka-python==0.9.4 \
     --hash=sha256:6cd463b688d98fec1c1f602e316eb7745aef0e55dc57fe9ff2f203cf0865c8c7
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 python-ldap==2.4.20 \
     --hash=sha256:4b8891539a3171d993cf7896b632ff088a4c707ae85ac3c77db1454f7949f3e2
 
 # RBTools is needed to support the MozReview server. It isn't needed by the
 # hg leader server. But installing it doesn't really hurt.
 RBTools==0.7.5 \
     --hash=sha256:28809def27e530ba5c13d37be8eb9ca31a24786cc0d0bd6d682f0009d94891a4

--- a/ansible/roles/hg-ssh/files/requirements-hg-pre.txt
+++ b/ansible/roles/hg-ssh/files/requirements-hg-pre.txt
@@ -1,2 +1,2 @@
-Mercurial==4.1 \
-    --hash=sha256:7b33c32cdd1d518bc2e2ae223e6ef63c486cf52e9d01a45b99cf8eab7bea5274
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194

--- a/ansible/roles/hg-ssh/files/requirements-tools.txt
+++ b/ansible/roles/hg-ssh/files/requirements-tools.txt
@@ -23,18 +23,18 @@ jmespath==0.9.0 \
     --hash=sha256:ade5261b0d7d34b6f53accc91e6881b579b40161ed575e6ac465de5edad32815
 
 kafka-python==0.9.4 \
     --hash=sha256:6cd463b688d98fec1c1f602e316eb7745aef0e55dc57fe9ff2f203cf0865c8c7
 
 kombu==3.0.35 \
     --hash=sha256:2c59a5e087d5895675cdb4d6a38a0aa147f0411366e68330a76e480ba3b25727
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 python-dateutil==2.5.3 \
     --hash=sha256:598499a75be2e5e18a66f12c00dd47a069de24794effeda4228bfc760f44f527
 
 python-hglib==1.9 \
     --hash=sha256:f4302892b2b8287cf326586c7280b9eadfc3d0c7cd3feba957429a8d9b1a60ce
 
 s3transfer==0.1.9 \

--- a/ansible/roles/hg-web/files/requirements-hgweb.txt
+++ b/ansible/roles/hg-web/files/requirements-hgweb.txt
@@ -1,11 +1,11 @@
 ipaddress==1.0.16 \
     --hash=sha256:935712800ce4760701d89ad677666cd52691fd2f6f0b340c8b4239a3c17988a5
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 mod-wsgi==4.5.14 \
     --hash=sha256:8e6d0ccdea6872b71da2ba0fe5d46ca38a6219becc521dcdc4516992c9fe3247
 
 Pygments==2.1.1 \
     --hash=sha256:05aee25c433d6155defbfbcb6c2e2b0ebf29d28138604867b62a304bd6bbb41d

--- a/ansible/roles/hg-web/files/requirements-replication.txt
+++ b/ansible/roles/hg-web/files/requirements-replication.txt
@@ -1,13 +1,13 @@
 kafka-python==0.9.4 \
     --hash=sha256:6cd463b688d98fec1c1f602e316eb7745aef0e55dc57fe9ff2f203cf0865c8c7
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 python-hglib==1.9 \
     --hash=sha256:f4302892b2b8287cf326586c7280b9eadfc3d0c7cd3feba957429a8d9b1a60ce
 
 PyYAML==3.11 \
     --hash=sha256:c36c938a872e5ff494938b33b14aaa156cb439ec67548fcab3535bb78b0846e8 \
     --hash=sha256:19bb3ac350ef878dda84a62d37c7d5c17a137386dde9c2ce7249c7a21d7f6ac9
 

--- a/ansible/roles/hg-web/files/requirements-tools.txt
+++ b/ansible/roles/hg-web/files/requirements-tools.txt
@@ -1,11 +1,11 @@
 Cython==0.25.1 \
     --hash=sha256:b72debd498e8d06487ae0631b3b7faf953d9fd2e364ffa80f1f35ec1801183d0
 
 futures==3.0.3 \
     --hash=sha256:04afa2a06ab7dcca9d81717b420a7a14826061e9b2614a5c77dd24c75ccf97e4
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 tabulate==0.7.5 \
     --hash=sha256:9071aacbd97a9a915096c1aaf0dc684ac2672904cd876db5904085d6dac9810e

--- a/ansible/roles/mercurial-yum/tasks/main.yml
+++ b/ansible/roles/mercurial-yum/tasks/main.yml
@@ -1,22 +1,22 @@
 ---
 
 # yum will incur network traffic when URLs are specified. Download the
 # package locally first so we can run offline after initial bootstrap.
 - name: download Mercurial package (CentOS 6)
-  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS6/mercurial-4.0.1-1.x86_64.rpm
-           dest=/var/tmp/mercurial-4.0.1-1.x86_64.rpm
-           sha256sum=47dd2169eb2e56b20196e0664ba9ae661325d7ce20d55d48c93e3875a4edbdab
+  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS6/mercurial-4.1.2-1.x86_64.rpm
+           dest=/var/tmp/mercurial-4.1.2-1.x86_64.rpm
+           sha256sum=cd3993cd4ade7f6eabbde26cbd4b614ead9a3677d42c714cc0f48d4091c82169
   when: ansible_distribution_major_version == '6'
 
 - name: download Mercurial package (CentOS 7)
-  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS7/mercurial-4.0.1-1.x86_64.rpm
-           dest=/var/tmp/mercurial-4.0.1-1.x86_64.rpm
-           sha256sum=4ed004977d5447351dea0a0cf1229dc2c25a944971a04fd6a4d9ca56e0ff20c0
+  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS7/mercurial-4.1.2-1.x86_64.rpm
+           dest=/var/tmp/mercurial-4.1.2-1.x86_64.rpm
+           sha256sum=123f3cbdce712b7097c14ba09533c8cb625ef731cd3acfd26c11981e55eaa255
   when: ansible_distribution_major_version == '7'
 
 - name: Install patch package
   yum: name=patch state=present
 
 # The yum module is slow. Run commands manually.
 - name: installed Mercurial
-  command: /usr/bin/yum localinstall -y /var/tmp/mercurial-4.0.1-1.x86_64.rpm
+  command: /usr/bin/yum localinstall -y /var/tmp/mercurial-4.1.2-1.x86_64.rpm

--- a/ansible/roles/mozreview-virtualenv/files/requirements.txt
+++ b/ansible/roles/mozreview-virtualenv/files/requirements.txt
@@ -62,18 +62,18 @@ importlib==1.0.3 \
     --hash=sha256:65f342a604a2e1028707c5e055266ab2431c26e20fe10780b423320870884dac
 
 kombu==3.0.30 \
     --hash=sha256:fecb34edf4852064f385dbf53969047b22353d3608a576497dd05f71b943fae6
 
 Markdown==2.4.1 \
     --hash=sha256:812ec5249f45edc31330b7fb06e52aaf6ab2d83aa27047df7cb6837ef2d269b6
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 mimeparse==0.1.3 \
     --hash=sha256:534ff6feefe1cd03984f444e6415aacc79c0a85f3b868ec41a2fd5003004c31e
 
 mod-wsgi==4.5.14 \
     --hash=sha256:8e6d0ccdea6872b71da2ba0fe5d46ca38a6219becc521dcdc4516992c9fe3247
 
 MozillaPulse==1.0.1 \

--- a/testing/docker/builder-hgweb-chroot/requirements.txt
+++ b/testing/docker/builder-hgweb-chroot/requirements.txt
@@ -1,11 +1,11 @@
 jsmin==2.1.2 \
     --hash=sha256:5e710e9db14f210dfd55ebec43bca5c812d34c5b6179dbcba2e61d9f965bf4e1
 
-Mercurial==4.0.1 \
-    --hash=sha256:6aa4ade93c1b5e11937820880a466ebf1c824086d443cd799fc46e2617250d40
+Mercurial==4.1.2 \
+    --hash=sha256:09415253fb409a77e19b9951532a3c22c4e07e74bab80652527064617daab194
 
 mozbuild==0.2 \
     --hash=sha256:24227608fc3c735fbb5c629d0540a600368c1d5e57013dd39272a0a5c9cccb13
 
 mozfile==1.2 \
     --hash=sha256:d3b00f336c6a89449bd78dd3ae65d74eb98497438d1ccfec07af0a736d20e957