[YoshihitoAso]

📌 Description

Update certifi to 2026.10.19 to address GHSA-6q48-6c7w-9gw2, which concerns trust in an emSign root with compromised intermediate CA keys. Clients trusting the affected CA bundle may be exposed to HTTPS interception or modification by an on-path attacker.

This hotfix targets dev-26.3. Rebuild and redeploy container images to use the corrected CA bundle.

✅ Related Issues

• GHSA-6q48-6c7w-9gw2
• Related fix for dev-26.6: fix: update certifi for GHSA-6q48-6c7w-9gw2 (dev-26.6) #1893

🔄 Changes

• Update the locked certifi version from 2025.4.26 to 2026.10.19.
• Require certifi>=2026.10.19 through a uv constraint to prevent resolution to an affected version.
• Keep every other locked package and the Python 3.13.11 requirement unchanged.
• Pin all external GitHub Actions references in workflows and the composite action to full commit SHAs, retaining their existing major versions, to satisfy the repository's Actions policy.

📌 Checklist

• I have added tests where necessary. (No new automated tests required for this CA bundle update.)
• I have updated the documentation where necessary. (Added an inline comment explaining the security constraint; no user-facing documentation changes required.)

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	37858	1732	3700	770	95%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
1268	0 💤	0 ❌	0 🔥	10m 34s ⏱️