[dinakarjs]

What

Update certifi from 2026.7.22 to 2026.10.19, with regenerated hashes, in the dev, docs, release and isolated governance lockfiles. Only those four three-line lock entries change; no other dependency, source, workflow or audit exception changes.

Why

PR #264's security-scan job fails on PYSEC-2026-4320 and names 2026.10.19 as the fixed release. Its new pip-check step passes. This separate update fixes the existing locked dependency; #264 retains its CI-only scope. No existing open certifi PR was found before preparing this change.

Security impact

Updates the existing certificate trust-bundle dependency for the published advisory reported by pip-audit. No verification bypass, ignored advisory or changed transport policy. This is not an independent vulnerability assessment.

Test plan

Exact parent 806d114; candidate 0e51014; Linux/Python 3.12.14.

• All four locks regenerated with their documented uv pip compile inputs, --generate-hashes --universal --python-version 3.11 and --upgrade-package certifi==2026.10.19; governance override retained. Only certifi version/hash entries changed.
• Updated the existing hash-locked dev environment with --require-hashes and installed this checkout with --no-deps -e .; pip check passes and pip-audit reports no known vulnerabilities. The old hosted environment provides the failing-before control linked above.
• Unit and conformance suites: 843 passed, 2 hardware skips.
• Ruff, mypy (47 source files), configured Bandit and git diff --check pass.
• Published tree 5f4b9fdfb017531995edaebd817069f9445a0298 equals the tested local tree.
• Hosted Windows/Python matrix and maintainer review remain required. Docs/release/governance environments were recompiled, not separately installed/executed locally. No release, hardware run or live TLS experiment performed.

DCO sign-off

• Contribution carries Signed-off-by and is submitted under the Developer Certificate of Origin.

Prepared with Codex; self-review is not independent maintainer approval.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[noah-ing]

Reviewed head 0e51014: the four lockfiles change only certifi 2026.7.22 to 2026.10.19 and its published hashes. The substantive hosted checks pass.

[dinakarjs]

@carloshvp @zohebk8s — this exact-head certifi repair remains green and independently approved by @noah-ing. New focused timestamp fix #269 currently stops at the inherited certifi audit finding, so this dependency repair is its existing prerequisite. Please assess it for the required maintainer approval; #269 retains its separate delegation-security review requirement.

[carloshvp]

Reviewed exact head 0e51014397a383d95a67707729a4bd4bf8fecd13 in an isolated checkout.

Approving the focused certifi repair. All four lockfiles change only certifi and its two artifact hashes; the hashes match official PyPI metadata and other pins/platform markers are preserved.

Independent fresh hash-locked validation: editable no-deps installation and pip check pass; the unit plus conformance selection passes 829 tests with 16 skips. Whitespace checks pass.

There is a current audit follow-up before merge: a fresh pip-audit now reports opentelemetry-api 1.44.0 / CVE-2026-114603, fixed in 1.45.1. I audited the unmodified parent lock too: it reports both certifi and OpenTelemetry; this PR removes the certifi finding and retains the unchanged OpenTelemetry dependency. Please carry that separate lock repair through normal validation and obtain a current successful hosted matrix. The earlier green audit is not a clean audit today. The commit carries DCO sign-off.

Sources: https://pypi.org/pypi/certifi/2026.10.19/json and GHSA-xcq7-p3pf-p88h

Reviewed with OpenAI Codex.

[zohebk8s]

Approving. Verified on 0e51014.

Both hashes are the complete file set for certifi 2026.10.19 on PyPI, sdist 035c1e85… and wheel 42d35340…, and they are byte-identical to the pair I confirmed yesterday for the same bump in another repository, so they are checked twice over. OSV gives PYSEC-2026-4320 as an alias of GHSA-6q48-6c7w-9gw2, the emSign root compromise, with the affected range running from 2019.03.09 to 2026.10.19. So the old pin was genuinely in range and 2026.10.19 is the advisory's own fix rather than merely a later release.

Completeness checks out too: agt.txt, dev.txt, docs.txt and release.txt are the four certifi pins in the tree and all four move together.

One thing to settle alongside this. Dependabot's #279 makes the same bump in docs.txt alone, so it is a strict subset of this PR and the two conflict on that file. This one should land and #279 should close; reviewing both is wasted effort.

[rajnisht7]

Closing in favor of #298