fix(deps): require certifi>=2026.10.19

certifi 2026.10.19 drops the emSign ECC Root CA - G3 root after the eMudhra
intermediate CA key compromise. Require it as a direct dependency so pip installs get the new bundle too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: lawrence-u10d

CHANGELOG.md

@@ -1,7 +1,7 @@
 ## 0.46.6
 
 ### Fixes
-* Bump locked `certifi` to 2026.10.19, which removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. Only the lockfile changes; the `certifi` requirement for installs is unchanged, so upgrade `certifi` in your own environment.
+* Bump locked `certifi` to 2026.10.19, which removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. `certifi` is now also a direct dependency at `>=2026.10.19`, so pip installs pick up the new bundle too.
 
 ## 0.46.5
 

gen.yaml

@@ -41,6 +41,7 @@ python:
       uvloop: '>=0.22.1'
     main:
       aiofiles: '>=25.1.0'
+      certifi: '>=2026.10.19'
       httpx: '>=0.28.1'
       pypdf: '>=6.9.2'
       pypdfium2: '>=5.6.0'

pyproject.toml

@@ -7,6 +7,7 @@ readme = "README-PYPI.md"
 requires-python = ">=3.11"
 dependencies = [
     "aiofiles >=25.1.0",
+    "certifi >=2026.10.19",
     "httpcore >=1.0.9",
     "httpx >=0.28.1",
     "pydantic >=2.12.5",