--- a/ansible/roles/hg-reviewboard/files/requirements-hgweb.txt
+++ b/ansible/roles/hg-reviewboard/files/requirements-hgweb.txt
@@ -1,15 +1,15 @@
 # We need RBTools in the hgweb venv because we support pushing via HTTP.
 # This is different from hg.mozilla.org's configuration.
 
 --find-links https://downloads.reviewboard.org/releases/RBTools/0.7/
 
-Mercurial==4.2 \
-    --hash=sha256:23a412308fc9c2b354a0e91a89588a4af2af061b47da80bc4233ccb0cceef47d
+Mercurial==4.2.2 \
+    --hash=sha256:b20132dec5ae6d27ee43a133144069895befe09f7e454bfa9e39950a185f0afe
 
 mod-wsgi==4.5.14 \
     --hash=sha256:8e6d0ccdea6872b71da2ba0fe5d46ca38a6219becc521dcdc4516992c9fe3247
 
 Pygments==2.1.1 \
     --hash=sha256:05aee25c433d6155defbfbcb6c2e2b0ebf29d28138604867b62a304bd6bbb41d
 
 python-ldap==2.4.20 \

--- a/ansible/roles/hg-web/files/requirements-hgweb.txt
+++ b/ansible/roles/hg-web/files/requirements-hgweb.txt
@@ -1,11 +1,11 @@
 ipaddress==1.0.16 \
     --hash=sha256:935712800ce4760701d89ad677666cd52691fd2f6f0b340c8b4239a3c17988a5
 
-Mercurial==4.2 \
-    --hash=sha256:23a412308fc9c2b354a0e91a89588a4af2af061b47da80bc4233ccb0cceef47d
+Mercurial==4.2.2 \
+    --hash=sha256:b20132dec5ae6d27ee43a133144069895befe09f7e454bfa9e39950a185f0afe
 
 mod-wsgi==4.5.14 \
     --hash=sha256:8e6d0ccdea6872b71da2ba0fe5d46ca38a6219becc521dcdc4516992c9fe3247
 
 Pygments==2.1.1 \
     --hash=sha256:05aee25c433d6155defbfbcb6c2e2b0ebf29d28138604867b62a304bd6bbb41d

--- a/testing/requirements-hgdev.txt
+++ b/testing/requirements-hgdev.txt
@@ -12,18 +12,18 @@ feedparser==5.1.3 \
 # For hgmo extension.
 ipaddress==1.0.16 \
     --hash=sha256:935712800ce4760701d89ad677666cd52691fd2f6f0b340c8b4239a3c17988a5
 
 # mozbuild dependency.
 jsmin==2.1.1 \
     --hash=sha256:582f70f5fef561c8d561271206f45258d0c420eec31a8628914e87c73a2192e1
 
-Mercurial==4.2 \
-    --hash=sha256:23a412308fc9c2b354a0e91a89588a4af2af061b47da80bc4233ccb0cceef47d
+Mercurial==4.2.2 \
+    --hash=sha256:b20132dec5ae6d27ee43a133144069895befe09f7e454bfa9e39950a185f0afe
 
 mock==1.0.1 \
     --hash=sha256:b839dd2d9c117c701430c149956918a423a9863b48b09c90e30a6013e7d2f44f \
     --hash=sha256:8f83080daa249d036cbccfb8ae5cc6ff007b88d6d937521371afabe7b19badbc
 
 # For moz.build reading in hgmo extension.
 mozbuild==0.2 \
     --hash=sha256:24227608fc3c735fbb5c629d0540a600368c1d5e57013dd39272a0a5c9cccb13