[YoshihitoAso]

📌 Description

Update certifi to 2026.10.19 to address GHSA-6q48-6c7w-9gw2, which concerns trust in an emSign root with compromised intermediate CA keys. Clients trusting the affected CA bundle may be exposed to HTTPS interception or modification by an on-path attacker.

This hotfix targets dev-25.12. Rebuild and redeploy container images to use the corrected CA bundle. GitHub Actions references are also pinned to full commit SHAs to satisfy the repository's Actions policy.

✅ Related Issues

• GHSA-6q48-6c7w-9gw2
• Related fixes: fix: update certifi for GHSA-6q48-6c7w-9gw2 (dev-26.6) #1893 (dev-26.6), fix: update certifi and pin GitHub Actions (dev-26.3) #1894 (dev-26.3)

🔄 Changes

• Update the locked certifi version from 2025.4.26 to 2026.10.19.
• Require certifi>=2026.10.19 through a uv constraint to prevent resolution to an affected version.
• Keep every other locked package and the Python 3.13.11 requirement unchanged.
• Pin 22 previously unpinned external GitHub Actions references in workflows and the composite action to full commit SHAs, retaining their existing major versions.

📌 Checklist

• I have added tests where necessary. (No new automated tests required for the CA bundle and action reference updates.)
• I have updated the documentation where necessary. (Added an inline comment explaining the security constraint and version comments for pinned actions; no user-facing documentation changes required.)

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	45776	1584	96%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
1538	0 💤	0 ❌	0 🔥	12m 26s ⏱️