[man8]

Description

Bumps the locked certifi from 2025.4.26 to 2026.10.23, produced by uv lock --upgrade-package certifi. uv.lock is the only file changed, and certifi is the only package the resolver moved.

Motivation and Context

Raised by Aikido. certifi releases before 2026.10.18 bundle the emSign ECC Root CA - G3 root certificate. Eight eMudhra intermediate CAs that chain to it have compromised private keys and have been revoked, so a holder of one of those keys can issue certificates that a certifi-backed client would trust for any hostname.

certifi is not a dependency of the published package: dependencies in pyproject.toml is empty, and certifi reaches the lockfile only transitively, through requests in the dev extra. The wheel is therefore unaffected, and pyproject.toml is unchanged; the fix is to the development and CI environment.

2026.10.23 is the latest release on PyPI. It declares requires_python >=3.7 and carries the Python 3.8 classifier, so it covers the whole CI matrix (3.8 to 3.13). The sdist and wheel sha256 hashes in uv.lock match PyPI's, and neither file is yanked.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

From the branch, each run separately, as CI invokes them, on Python 3.13:

• uv sync --all-extras --dev: installed certifi==2026.10.23
• uv run ruff check .: All checks passed!
• uv run ruff format --check .: 23 files already formatted
• uv run mypy src/: Success: no issues found in 2 source files
• uv run pytest tests/ -v --tb=short: 153 passed

Checklist

• My code follows the project's code style (checked with ruff check and ruff format --check)
• I have performed a self-review of my own code
• My commit messages follow Conventional Commits specification
• New and existing unit tests pass locally with my changes (uv run pytest)
• I have checked my code passes type checking (uv run mypy src/)
• My changes maintain backwards compatibility

Additional Notes

CHANGELOG.md is deliberately unchanged; the next release's changelog is prepared separately.

Post-merge checks, recorded on the tracking work item's post-merge verification section:

1. Does merging run CI on main? Yes: the Test workflow (Python 3.8 to 3.13) and CodeQL default-setup code scanning run on push to main. Verify both are green on the merge commit, and that uv.lock there lists certifi 2026.10.23.
2. Does this change take over or supersede another PR? Yes: it supersedes build(deps): bump certifi to 2026.10.23 #24, the same commit content re-filed under a different author so that CodeRabbit reviews it. build(deps): bump certifi to 2026.10.23 #24 is closed unmerged.
3. Does merging trigger a deploy, scheduled job or downstream catch-up? No: the Release workflow runs only on v* tags, and nothing else deploys from main. The scanner finding should clear once main carries the new lock.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pk5H9KCpSX7PmWxKeGd9Qd

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 20237da1-4f15-477b-9ce4-544a622f7f71

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T15:18:51.855684Z	2c1cdd8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.