[YoshihitoAso]

📌 Description

Update certifi to 2026.10.19 to address GHSA-6q48-6c7w-9gw2, which concerns trust in an emSign root with compromised intermediate CA keys. Clients trusting the affected CA bundle may be exposed to HTTPS interception or modification by an on-path attacker.

This hotfix targets dev-26.6. Rebuild and redeploy container images to use the corrected CA bundle.

✅ Related Issues

• GHSA-6q48-6c7w-9gw2

🔄 Changes

• Update the locked certifi version from 2026.5.20 to 2026.10.19.
• Require certifi>=2026.10.19 through a uv constraint to prevent resolution to an affected version.
• Exempt certifi from the seven-day release-age delay so the security fix can be resolved immediately. All other packages retain the existing delay.
• Keep every other locked package unchanged.

📌 Checklist

• I have added tests where necessary. (No new automated tests required for this CA bundle update.)
• I have updated the documentation where necessary. (Added an inline comment explaining the security constraint and release-age exception; no user-facing documentation changes required.)

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	37457	1470	3524	647	96%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
1281	0 💤	0 ❌	0 🔥	11m 4s ⏱️