mpnowacki-reef · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
@@ -6,7 +6,7 @@ on:
 
 env:
   PYTHON_DEFAULT_VERSION: "3.14"
-  UV_VERSION: "0.8.24"
+  UV_VERSION: "0.13.4"
 
 jobs:
   deploy:

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -8,7 +8,7 @@ on:
 
 env:
   PYTHON_DEFAULT_VERSION: "3.14"
-  UV_VERSION: "0.8.24"
+  UV_VERSION: "0.13.4"
 
 jobs:
   lint:

diff --git a/changelog.d/+certifi-minimum.changed.md b/changelog.d/+certifi-minimum.changed.md
@@ -0,0 +1 @@
+Require certifi 2026.10.19 or newer.
diff --git a/changelog.d/+ci-pip-minimum.infrastructure.md b/changelog.d/+ci-pip-minimum.infrastructure.md
@@ -0,0 +1 @@
+Require pip 26.2.2 or newer in the Nox runner, lint, build, and test environments and update GitHub Actions to uv 0.13.4 to address the emSign CA certificate security incident.
diff --git a/noxfile.py b/noxfile.py
@@ -195,7 +195,7 @@ def build(session):
     if len(sdists) != 1:
         session.error(f'Expected exactly one source distribution, found {len(sdists)}: {sdists!r}')
 
-    session.install(str(sdists[0]))
+    session.install('pip>=26.2.2', str(sdists[0]))
     session.cd('dist')  # avoid importing from the checkout instead of the built package
     session.run(
         'python',

diff --git a/pyproject.toml b/pyproject.toml
@@ -23,6 +23,7 @@ classifiers = [
 ]
 dependencies = [
     "annotated_types>=0.5.0",
+    "certifi>=2026.10.19",
     "logfury<2.0.0,>=1.0.1",
     "requests<3.0.0,>=2.33.0",
     "typing-extensions>=4.7.1; python_version < '3.12'",
@@ -38,19 +39,21 @@ full = [
 [dependency-groups]
 nox = [
     "nox>=2025.11.12",
+    "pip>=26.2.2",
 ]
 format = [
     "ruff~=0.8.4",
 ]
 lint = [
-    "pip>=26.1",
+    "pip>=26.2.2",
     "ruff~=0.8.4",
     "pytest>=9.0.3,<10",
     "tenacity>=9.1.4,<10",
     "liccheck==0.9.2",
     "setuptools",
 ]
 test = [
+    "pip>=26.2.2",
     "coverage>=7.13.5,<8",
     "pytest>=9.0.3,<10",
     "pytest-cov>=7.1.0,<8",

diff --git a/uv.lock b/uv.lock
-Original file line number
+Diff line change
@@ Expand Up / @@ -6,7 +6,7 @@ on: @@
     env:
       PYTHON_DEFAULT_VERSION: "3.14"
-      UV_VERSION: "0.8.24"
+      UV_VERSION: "0.13.4"
     jobs:
       deploy:
@@ Expand Down @@
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Require pip 26.2.2 or newer in the Nox runner, lint, build, and test environments and update GitHub Actions to uv 0.13.4 to address the emSign CA certificate security incident.