[man8-octoflow]

Description

Bumps the locked certifi from 2025.4.26 to 2026.10.23, produced by uv lock --upgrade-package certifi. uv.lock is the only file changed, and certifi is the only package the resolver moved.

Motivation and Context

Raised by Aikido. certifi releases before 2026.10.18 bundle the emSign ECC Root CA - G3 root certificate. Eight eMudhra intermediate CAs that chain to it have compromised private keys and have been revoked, so a holder of one of those keys can issue certificates that a certifi-backed client would trust for any hostname.

certifi is not a dependency of the published package: dependencies in pyproject.toml is empty, and certifi reaches the lockfile only transitively, through requests in the dev extra. The wheel is therefore unaffected, and pyproject.toml is unchanged; the fix is to the development and CI environment.

2026.10.23 is the latest release on PyPI. It declares requires_python >=3.7 and carries the Python 3.8 classifier, so it covers the whole CI matrix (3.8 to 3.13). The sdist and wheel sha256 hashes in uv.lock match PyPI's, and neither file is yanked.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

From the branch, each run separately, as CI invokes them, on Python 3.13:

• uv sync --all-extras --dev: installed certifi==2026.10.23
• uv run ruff check .: All checks passed!
• uv run ruff format --check .: 23 files already formatted
• uv run mypy src/: Success: no issues found in 2 source files
• uv run pytest tests/ -v --tb=short: 153 passed

Checklist

• My code follows the project's code style (checked with ruff check and ruff format --check)
• I have performed a self-review of my own code
• My commit messages follow Conventional Commits specification
• New and existing unit tests pass locally with my changes (uv run pytest)
• I have checked my code passes type checking (uv run mypy src/)
• My changes maintain backwards compatibility

Additional Notes

CHANGELOG.md is deliberately unchanged; the next release's changelog is prepared separately.

Post-merge checks, recorded on the tracking work item's post-merge verification section:

1. Does merging run CI on main? Yes: the Test workflow (Python 3.8 to 3.13) and CodeQL default-setup code scanning run on push to main. Verify both are green on the merge commit, and that uv.lock there lists certifi 2026.10.23.
2. Does this change take over or supersede another PR? No.
3. Does merging trigger a deploy, scheduled job or downstream catch-up? No: the Release workflow runs only on v* tags, and nothing else deploys from main. The scanner finding should clear once main carries the new lock.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pk5H9KCpSX7PmWxKeGd9Qd

[coderabbitai]

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3c1905a4-2594-4449-97f5-bad3ed4e651a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[man8-octoflow]

@coderabbitai review

[man8]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review skipped.

[man8-octoflow]

Superseded by #25: the same change, re-filed under a different author so that CodeRabbit reviews it.