[PragalvaXFREZ]

Summary

• Update only the certifi entry in uv.lock, from 2026.2.25 to 2026.10.19, including the PyPI artifact hashes.
• Pick up the emSign trust-store fix described in GHSA-6q48-6c7w-9gw2. The follow-up .19 release restores the unaffected emSign roots removed in .18.

This applies to the documented uv sync --all-packages setup and CI, which install the locked bundle. An unchanged Python 3.12 workspace install was checked first: HTTPX 0.28.1's default client context still trusted 6 of the 12 published eMudhra test chains. With this lock update, the same offline verification rejects all 12. This is a downstream trust-store update, not evidence that Repowise was compromised. The Dockerfile's separate pip installation path is not covered by this finding.

Related Issues

Upstream advisory above. No matching open certifi-fix issue or PR found.

Test Plan

Local validation used current upstream main plus this lock-only patch. The submitted branch is based on the fork's existing main so it does not push unrelated upstream workflow updates.

• uv lock --check
• uv sync --all-packages --python 3.12 --locked
• .venv/bin/python -m pytest tests/providers/ tests/unit/test_providers/ -q --tb=short: 566 passed
• .venv/bin/ruff check .
• git diff --check
• Parsed old/new lockfiles: every other package and the lock metadata are unchanged; the new certifi artifact hashes and sizes match PyPI.
• Offline trust regression: export the CA certificates from a default httpx.Client() SSL context, then run OpenSSL verification against the 12 PEM chains from the incident disclosure. Verification includes the server purpose and hostname and disables fallback CA directories/stores. Before: 6 accepted. After: 0 accepted, with issuer-trust failures. No private keys or network-failure assumptions are involved.

The full tests/providers/ tests/unit/ run was attempted with four workers, but stopped after several minutes without completing collection. Its result is unverified. The focused provider suites above completed successfully. No frontend files changed, so the web build was not run.

Prepared with AI assistance; the validation results above come from actual execution.

[PragalvaXFREZ]

@RaghavChamadiya, heads-up on the publicly disclosed certifi/emSign issue. This is a lock-only update for the documented uv setup: the default HTTPX trust store accepted 6/12 incident test chains before the change and rejects all 12 after it. The focused provider suites pass (566 tests); full CI is running.