From c58b58ae23c2bb3c72675d4b59e08816e62cdc44 Mon Sep 17 00:00:00 2001
From: derek-globus <derek@globus.org>
Date: Thu, 22 Oct 2026 15:13:35 -0500
Subject: [PATCH] Pin certifi to an uncompromised version number. (3.x)

---
 changelog.d/20261022_151229_derek_pin_3_x_certifi.rst | 5 +++++
 pyproject.toml                                        | 1 +
 2 files changed, 6 insertions(+)
 create mode 100644 changelog.d/20261022_151229_derek_pin_3_x_certifi.rst

diff --git a/changelog.d/20261022_151229_derek_pin_3_x_certifi.rst b/changelog.d/20261022_151229_derek_pin_3_x_certifi.rst
new file mode 100644
index 000000000..d0938610c
--- /dev/null
+++ b/changelog.d/20261022_151229_derek_pin_3_x_certifi.rst
@@ -0,0 +1,5 @@
+
+Security
+--------
+
+- Pin certifi to an uncompromised version number. (:pr:`NUMBER`)
diff --git a/pyproject.toml b/pyproject.toml
index fec83d7ce..1d795c0fd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,6 +24,7 @@ classifiers = [
 requires-python = ">=3.8"
 dependencies = [
     "requests>=2.19.1,<3.0.0",
+    "certifi>=2026.10.19",
     "pyjwt[crypto]>=2.0.0,<3.0.0",
     # cryptography 3.4.0 is known-bugged, see:
     #   https://github.com/pyca/cryptography/issues/5756