fix(deps): bump certifi to 2026.10.19 (#593)

Author: lawrence-u10d

CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.1.16
+
+### Fixes
+
+- **Bump locked `certifi` to 2026.10.19**: The release removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. The Docker image installs from the lockfile and picks it up, and `certifi>=2026.10.19` is recorded in `constraint-dependencies` so future relocks cannot fall below it.
+- **Bump uv in the Docker image to 0.13.4**: Earlier uv releases bundle a CA store that trusts the same emSign ECC Root CA - G3 ([GHSA-hq85-5cpj-mr62](https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62)). uv 0.13.4 drops it, so package downloads during the image build no longer trust certificates chaining to that root.
+
 ## 0.1.15
 
 ### Fixes

Dockerfile

@@ -11,7 +11,7 @@ ARG PYTHON_VERSION="3.12"
 # Set up environment
 ENV PYTHON=python${PYTHON_VERSION}
 
-COPY --from=ghcr.io/astral-sh/uv:0.10.0 /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv
 
 USER root
 

prepline_general/api/__version__.py

@@ -1 +1 @@
-__version__ = "0.1.15"  # pragma: no cover
+__version__ = "0.1.16"  # pragma: no cover

pyproject.toml

@@ -52,6 +52,8 @@ constraint-dependencies = [
     "starlette>=1.1.0",
     # lxml >=6.1.1 fixes CVE-2026-41066 (HIGH)
     "lxml>=6.1.1",
+    # certifi >=2026.10.19 removes emSign ECC Root CA - G3 (eMudhra intermediate CA key compromise)
+    "certifi>=2026.10.19",
 ]
 
 [[tool.uv.index]]