[aikido-autofix]

Upgrade certifi to remove compromised eMudhra intermediate CA certificates that enable man-in-the-middle attacks and arbitrary certificate issuance.

✅ 1 CVE resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-6q48-6c7w-9gw2	🚨 CRITICAL	[certifi] Compromised eMudhra intermediate CA certificates allow attackers to issue valid certificates for any hostname and intercept TLS traffic in applications using the bundled CA store. Removal of affected emSign roots prevents unauthorized certificate issuance and man-in-the-middle attacks.

🤖 Remediation details

Fix critical security vulnerability in certifi (GHSA-6q48-6c7w-9gw2)

This PR remediates a critical vulnerability in the transitive dependency certifi by upgrading it to the patched version 2026.10.19. The fix is a lockfile-only change — no pyproject.toml edits were required — because all parent packages already declared unconstrained version ranges for certifi.

certifi

certifi is a transitive dependency pulled in via httpx → certifi and httpx → httpcore → certifi. Both parent packages ([email protected] and [email protected]) already allowed any version of certifi, so no manifest changes were needed. Running uv lock --upgrade-package certifi was sufficient to advance the single resolved lockfile instance from 2026.2.25 to 2026.10.19, satisfying the patched version floor for GHSA-6q48-6c7w-9gw2.

Version changes

Package	From	To	Why updated
certifi	2026.2.25	2026.10.19	Transitive CVE fix (lockfile refresh via httpx / httpcore parent chains)