[YoshihitoAso]

📌 Description

Address GHSA-6q48-6c7w-9gw2 by upgrading certifi from 2026.5.20 to 2026.10.19, which removes the affected emSign root CA from the bundled trust store.

✅ Related Issues

• GHSA-6q48-6c7w-9gw2

🔄 Changes

• Require certifi>=2026.10.19 through a transitive dependency constraint.
• Exempt certifi from uv’s seven-day release cooldown to apply security fixes immediately.
• Regenerate uv.lock; certifi is the only package version changed.

Validation:

• make test_guardrail_check: 3 passed.
• Confirmed the CA bundle loads successfully and no longer contains emSign ECC Root CA - G3.

📌 Checklist

• I have added tests where necessary. (No new tests needed for this dependency update; existing guardrail tests and a CA bundle smoke check passed.)
• I have updated the documentation where necessary. (Added a dependency configuration comment identifying the advisory and explaining the change.)

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	37608	1478	3540	649	95%

report-only-changed-files is enabled. No changed files were found in the coverage report :)

Tests	Skipped	Failures	Errors	Time
1285	0 💤	0 ❌	0 🔥	8m 14s ⏱️