--- a/ansible/roles/docker-hg-web/files/requirements-mozbuild.txt
+++ b/ansible/roles/docker-hg-web/files/requirements-mozbuild.txt
@@ -1,11 +1,11 @@
 jsmin==2.1.2 \
     --hash=sha256:5e710e9db14f210dfd55ebec43bca5c812d34c5b6179dbcba2e61d9f965bf4e1
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 mozbuild==0.2 \
     --hash=sha256:24227608fc3c735fbb5c629d0540a600368c1d5e57013dd39272a0a5c9cccb13
 
 mozfile==1.2 \
     --hash=sha256:d3b00f336c6a89449bd78dd3ae65d74eb98497438d1ccfec07af0a736d20e957

--- a/ansible/roles/hg-reviewboard/files/requirements-hgweb.txt
+++ b/ansible/roles/hg-reviewboard/files/requirements-hgweb.txt
@@ -1,15 +1,15 @@
 # We need RBTools in the hgweb venv because we support pushing via HTTP.
 # This is different from hg.mozilla.org's configuration.
 
 --find-links https://downloads.reviewboard.org/releases/RBTools/0.7/
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 mod-wsgi==4.4.11 \
     --hash=sha256:7dd9540db9797f2a5b491eaff6344643050553ebcbb62f775762cbe3a0343c25
 
 Pygments==2.1.1 \
     --hash=sha256:05aee25c433d6155defbfbcb6c2e2b0ebf29d28138604867b62a304bd6bbb41d
 
 python-ldap==2.4.20 \

--- a/ansible/roles/hg-reviewboard/files/requirements-pash.txt
+++ b/ansible/roles/hg-reviewboard/files/requirements-pash.txt
@@ -1,12 +1,12 @@
 --find-links https://downloads.reviewboard.org/releases/RBTools/0.7/
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 python-ldap==2.4.20 \
     --hash=sha256:4b8891539a3171d993cf7896b632ff088a4c707ae85ac3c77db1454f7949f3e2
 
 RBTools==0.7.5 \
     --hash=sha256:28809def27e530ba5c13d37be8eb9ca31a24786cc0d0bd6d682f0009d94891a4
 
 six==1.9.0 \

--- a/ansible/roles/hg-ssh/files/requirements-pash.txt
+++ b/ansible/roles/hg-ssh/files/requirements-pash.txt
@@ -1,11 +1,11 @@
 kafka-python==0.9.4 \
     --hash=sha256:6cd463b688d98fec1c1f602e316eb7745aef0e55dc57fe9ff2f203cf0865c8c7
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 python-ldap==2.4.20 \
     --hash=sha256:4b8891539a3171d993cf7896b632ff088a4c707ae85ac3c77db1454f7949f3e2
 
 six==1.9.0 \
     --hash=sha256:418a93c397a7edab23e5588dbc067ac74a723edb3d541bd4936f79476e7645da

--- a/ansible/roles/hg-ssh/files/requirements-tools.txt
+++ b/ansible/roles/hg-ssh/files/requirements-tools.txt
@@ -11,18 +11,18 @@ futures==3.0.3 \
     --hash=sha256:04afa2a06ab7dcca9d81717b420a7a14826061e9b2614a5c77dd24c75ccf97e4
 
 kafka-python==0.9.4 \
     --hash=sha256:6cd463b688d98fec1c1f602e316eb7745aef0e55dc57fe9ff2f203cf0865c8c7
 
 kombu==3.0.35 \
     --hash=sha256:2c59a5e087d5895675cdb4d6a38a0aa147f0411366e68330a76e480ba3b25727
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 python-hglib==1.9 \
     --hash=sha256:f4302892b2b8287cf326586c7280b9eadfc3d0c7cd3feba957429a8d9b1a60ce
 
 six==1.9.0 \
     --hash=sha256:418a93c397a7edab23e5588dbc067ac74a723edb3d541bd4936f79476e7645da
 
 tabulate==0.7.5 \

--- a/ansible/roles/hg-web/files/requirements-hgweb.txt
+++ b/ansible/roles/hg-web/files/requirements-hgweb.txt
@@ -1,11 +1,11 @@
 ipaddress==1.0.16 \
     --hash=sha256:935712800ce4760701d89ad677666cd52691fd2f6f0b340c8b4239a3c17988a5
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 mod-wsgi==4.4.11 \
     --hash=sha256:7dd9540db9797f2a5b491eaff6344643050553ebcbb62f775762cbe3a0343c25
 
 Pygments==2.1.1 \
     --hash=sha256:05aee25c433d6155defbfbcb6c2e2b0ebf29d28138604867b62a304bd6bbb41d

--- a/ansible/roles/hg-web/files/requirements-replication.txt
+++ b/ansible/roles/hg-web/files/requirements-replication.txt
@@ -1,13 +1,13 @@
 kafka-python==0.9.4 \
     --hash=sha256:6cd463b688d98fec1c1f602e316eb7745aef0e55dc57fe9ff2f203cf0865c8c7
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 python-hglib==1.9 \
     --hash=sha256:f4302892b2b8287cf326586c7280b9eadfc3d0c7cd3feba957429a8d9b1a60ce
 
 PyYAML==3.11 \
     --hash=sha256:c36c938a872e5ff494938b33b14aaa156cb439ec67548fcab3535bb78b0846e8 \
     --hash=sha256:19bb3ac350ef878dda84a62d37c7d5c17a137386dde9c2ce7249c7a21d7f6ac9
 

--- a/ansible/roles/hg-web/files/requirements-tools.txt
+++ b/ansible/roles/hg-web/files/requirements-tools.txt
@@ -1,8 +1,8 @@
 futures==3.0.3 \
     --hash=sha256:04afa2a06ab7dcca9d81717b420a7a14826061e9b2614a5c77dd24c75ccf97e4
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 tabulate==0.7.5 \
     --hash=sha256:9071aacbd97a9a915096c1aaf0dc684ac2672904cd876db5904085d6dac9810e

--- a/ansible/roles/mercurial-yum/tasks/main.yml
+++ b/ansible/roles/mercurial-yum/tasks/main.yml
@@ -1,22 +1,22 @@
 ---
 
 # yum will incur network traffic when URLs are specified. Download the
 # package locally first so we can run offline after initial bootstrap.
 - name: download Mercurial package (CentOS 6)
-  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS6/mercurial-3.8.4-1.x86_64.rpm
-           dest=/var/tmp/mercurial-3.8.4-1.x86_64.rpm
-           sha256sum=2a4654b1a8e5d47fc6a96c826210d057dcc78523de72f70d266e5fc5f5685c90
+  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS6/mercurial-3.9.1-1.x86_64.rpm
+           dest=/var/tmp/mercurial-3.9.1-1.x86_64.rpm
+           sha256sum=639263bb1b84d0caef0c619828ea850dca03af4f2b66a8db4ac9409da01c9f7f
   when: ansible_distribution_major_version == '6'
 
 - name: download Mercurial package (CentOS 7)
-  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS7/mercurial-3.8.4-1.x86_64.rpm
-           dest=/var/tmp/mercurial-3.8.4-1.x86_64.rpm
-           sha256sum=22850355ed4949906e922920651375af342b4ad7a6535cc5ce2ed088d91add01
+  get_url: url=https://s3-us-west-2.amazonaws.com/moz-packages/CentOS7/mercurial-3.9.1-1.x86_64.rpm
+           dest=/var/tmp/mercurial-3.9.1-1.x86_64.rpm
+           sha256sum=67543d6b8d855c7d4acf5adebf5ecda976a57edcf2c985410cf07fdba76e1aac
   when: ansible_distribution_major_version == '7'
 
 - name: Install patch package
   yum: name=patch state=present
 
 # The yum module is slow. Run commands manually.
 - name: installed Mercurial
-  command: /usr/bin/yum localinstall -y /var/tmp/mercurial-3.8.4-1.x86_64.rpm
+  command: /usr/bin/yum localinstall -y /var/tmp/mercurial-3.9.1-1.x86_64.rpm

--- a/ansible/roles/mozreview-virtualenv/files/requirements.txt
+++ b/ansible/roles/mozreview-virtualenv/files/requirements.txt
@@ -54,18 +54,18 @@ importlib==1.0.3 \
     --hash=sha256:65f342a604a2e1028707c5e055266ab2431c26e20fe10780b423320870884dac
 
 kombu==3.0.30 \
     --hash=sha256:fecb34edf4852064f385dbf53969047b22353d3608a576497dd05f71b943fae6
 
 Markdown==2.4.1 \
     --hash=sha256:812ec5249f45edc31330b7fb06e52aaf6ab2d83aa27047df7cb6837ef2d269b6
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 mimeparse==0.1.3 \
     --hash=sha256:534ff6feefe1cd03984f444e6415aacc79c0a85f3b868ec41a2fd5003004c31e
 
 mod-wsgi==4.4.11 \
     --hash=sha256:7dd9540db9797f2a5b491eaff6344643050553ebcbb62f775762cbe3a0343c25
 
 MozillaPulse==1.0.1 \

--- a/create-test-environment
+++ b/create-test-environment
@@ -182,21 +182,21 @@ if [ ! -d venv/hg ]; then
   echo "Cloning Mercurial repository"
   hg clone https://selenic.com/repo/hg venv/hg
 fi
 
 hg -R venv/hg pull
 
 mercurials=`pwd`/venv/mercurials
 
-for old in 3.0 3.0.1 3.0.2 3.1 3.1.1 3.1.2 3.2 3.2.1 3.2.2 3.2.3 3.2.4 3.3 3.3.2 3.3.3 3.4 3.4.1 3.5 3.5.1 3.6 3.7.1; do
+for old in 3.0 3.0.1 3.0.2 3.1 3.1.1 3.1.2 3.2 3.2.1 3.2.2 3.2.3 3.2.4 3.3 3.3.2 3.3.3 3.4 3.4.1 3.4.2 3.5 3.5.1 3.5.2 3.6 3.7.1; do
   rm -rf $mercurials/$old
 done
 
-for v in 3.4.2 3.5.2 3.6.2 3.7.2 3.8.1; do
+for v in 3.6.2 3.7.3 3.8.4; do
   destdir=$mercurials/$v
   if [ ! -d $destdir ]; then
     cd venv/hg
     hg up $v
     # We don't care about support files, which only slow us down, so
     # install-bin is the only target we need.
     make install-bin PREFIX=$destdir
     hg --config extensions.purge= purge --all

--- a/deploy-requirements.txt
+++ b/deploy-requirements.txt
@@ -11,18 +11,18 @@ Jinja2==2.7.3 \
     --hash=sha256:2e24ac5d004db5714976a04ac0e80c6df6e47e98c354cb2c0d82f8879d4f8fdb
 
 mach==0.5.1 \
     --hash=sha256:61bda1a1033c110f781427c479dd151a45fc45e46ce28e37fabf0d3cc2edf91e
 
 MarkupSafe==0.23 \
     --hash=sha256:a4ec1aff59b95a14b45eb2e23761a0179e98319da5a7eb76b56ea8cdc7b871c3
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 mozfile==1.1 \
     --hash=sha256:e1d8505c9d575051e0831ee659a982a2bbfaec37013dc946d60a3071a442888e
 
 mozinfo==0.7 \
     --hash=sha256:d27f75b668614f28df2e61b8aa4beb6f68f3c9936fc9139fae755728f2b4844a
 
 mozprocess==0.22 \

--- a/testing/docker/builder-hgweb-chroot/requirements.txt
+++ b/testing/docker/builder-hgweb-chroot/requirements.txt
@@ -1,11 +1,11 @@
 jsmin==2.1.2 \
     --hash=sha256:5e710e9db14f210dfd55ebec43bca5c812d34c5b6179dbcba2e61d9f965bf4e1
 
-Mercurial==3.8.4 \
-    --hash=sha256:4b2e3ef19d34fa1d781cb7425506a05d4b6b1172bab69d6ea78874175fdf3da6
+Mercurial==3.9.1 \
+    --hash=sha256:625e4fc7e85ec2278c2828bdc547fce74091b3bbe4d9eeeba2d61af51195df74
 
 mozbuild==0.2 \
     --hash=sha256:24227608fc3c735fbb5c629d0540a600368c1d5e57013dd39272a0a5c9cccb13
 
 mozfile==1.2 \
     --hash=sha256:d3b00f336c6a89449bd78dd3ae65d74eb98497438d1ccfec07af0a736d20e957