fix(deps): bump certifi to 2026.10.19

Merged
LA
12d ago
+15-5

Why

Eight eMudhra intermediate CA private keys were confirmed compromised (article). certifi 2026.10.19 drops the emSign ECC Root CA - G3 root. requests and httpx trust certifi's bundle and do not check revocation, so the older bundle accepts certificates chaining to that root.

What

  • uv.lock: certifi upgraded to 2026.10.19 (uv lock --upgrade-package certifi; no other packages changed).
  • Version bumped to 0.1.16 with a CHANGELOG entry.
  • Dockerfile: uv 0.10.0 -> 0.13.4. uv before 0.13.4 bundles a CA store that trusts the same emSign root (GHSA-hq85-5cpj-mr62).
  • No certifi floor added to pyproject.toml, so downstream installs are not constrained.

Tests: lock consistency checked locally; full suites left to CI.

Also adds certifi>=2026.10.19 to [tool.uv] constraint-dependencies, so future relocks can't fall below it.

🤖 Generated with Claude Code