fix(deps): bump certifi to 2026.10.19 in sandbox image requirements
Requested by Nikolas Garza ยท Slack thread
Description
Before: initial-requirements.txt pins certifi==2026.6.17, which has Dependabot alert GHSA-6q48-6c7w-9gw2.
After: initial-requirements.txt pins certifi==2026.10.19, the fixed version. It matches uv.lock.
This changes one line in the sandbox image requirements.
How: The CVE bot cannot edit this uv-pip-compile file, so #16337 missed it. This fixes the remaining certifi pin flagged by GHSA-6q48-6c7w-9gw2. Only the certifi line changes. Other pins stay the same.
Linear: none
How Has This Been Tested?
Checked that certifi 2026.10.19 exists on PyPI and that uv.lock uses it. The file has no hashes, and no other pin caps certifi.
Additional Options
- [Optional] Please cherry-pick this PR to the latest release version.
Generated by Claude Code
Summary by cubic
Fixes the Dependabot alert GHSA-6q48-6c7w-9gw2 by bumping certifi from 2026.6.17 to 2026.10.19 in the sandbox image initial-requirements.txt. The new pin matches uv.lock and only the certifi line changes.
Summary by CodeRabbit
- Bug Fixes
- Updated the bundled certificate authority package to a newer version, improving compatibility with current SSL/TLS certificates.