[abacchilb]

Description

DEVOPS-12141. Part of epic DEVOPS-12134 (eMudhra CA key compromise and Brotli decoder CVE-2026-111497). certifi 2026.10.18+ fixes GHSA-6q48-6c7w-9gw2 (flagged critical by Aikido) by dropping some of the emSign roots tied to the eMudhra intermediate CA key compromise. It does not drop all of them: 2026.10.23 still contains "emSign Root CA - G1" (verified from the PyPI wheel). This bump narrows the exposure; fully removing the remaining emSign and AAA Certificate Services roots needs a build-time distrust step in each production image, as in Labelbox/intelligence#31704, tracked under the epic.

Lock	Before	After
uv.lock	2025.8.3	2026.10.23
requirements.lock	2024.7.4	2026.10.23
requirements-dev.lock	2024.7.4	2026.10.23

These are dev/CI locks only; the published SDK does not pin certifi. The Rye locks were edited by hand (Rye is not installed locally). certifi has no dependencies, so this should equal what rye lock produces; worth a rye lock in CI to confirm.

Type of change

• Bug fix (non-breaking change which fixes an issue)

All Submissions

• Have you provided a description?
• Are your changes properly formatted?

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only CA bundle refresh for dev/CI with no application code changes; slightly alters TLS trust roots in those environments only.

Overview
Updates certifi to 2026.10.23 in requirements.lock, requirements-dev.lock, and uv.lock so dev/CI environments use a CA bundle that no longer trusts emSign roots removed after the eMudhra intermediate CA compromise (GHSA-6q48-6c7w-9gw2).

Prior pinned versions ranged from 2024.7.4 (Rye locks) to 2025.8.3 (uv.lock); only lockfile entries change—certifi remains a transitive dependency of requests and pyproj, not a direct pin on the published SDK.

^{Reviewed by Cursor Bugbot for commit c2c8433. Bugbot is set up for automated code reviews on this repo. Configure here.}

[abacchilb]

Closing and deprioritizing under DEVOPS-12141. This lockfile is dev/test-only and is not part of any deployed artifact, so the certifi bump has no production impact. Any matching Aikido finding will be accepted as not deployed.