[dinakarjs]

What

Update only certifi from 2026.7.22 to 2026.10.19 and its hashes in dev, runtime, docs and release locks.

Why

The current dev lock fails pip-audit with PYSEC-2026-4320 before CI reaches tests. Failing-before evidence on #794: https://github.com/agentrust-io/cmcp/actions/runs/39587966501/job/119181493730 . Keep this dependency correction separate from the documentation-environment change.

Security impact

Refreshes the existing certificate bundle for the advisory reported by pip-audit. No runtime source, transport policy, audit exception, lock-input policy or publishing permission changes.

Test plan

All four locks recompiled from documented commands with --universal --python-version 3.11 --generate-hashes and --upgrade-package certifi==2026.10.19; runtime stays constrained to the regenerated dev lock. A mechanical comparison confirms only certifi version/hash blocks change.

Fresh hash-locked Linux/Python 3.11.17 dev environment and no-deps editable checkout: dependency consistency, pip-audit, Ruff, mypy (76 files) and configured Bandit pass. Full unit suite: 2,539 passed, 6 skipped. Test-process proxy variables cleared for loopback traffic. Docs/runtime/release locks recompiled, not separately installed locally; full integration/confinement, hardware and live TLS validation were not run. Whitespace passes. Hosted matrix and independent review remain required.

Candidate 4f2e7e1; published tree cfb658e55c013052b32b9f445467a0dc663b340e. Prepared with Codex; DCO sign-off included. Independent maintainer review and hosted checks remain required.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[noah-ing]

Reviewed head 4f2e7e1: the four lockfiles change only certifi 2026.7.22 to 2026.10.19 and its published hashes. The substantive hosted checks pass.

[carloshvp]

Reviewed exact head 4f2e7e1ae34d735bd700b6718426f3d4fd0b8787 in an isolated checkout.

Approving the certifi lock repair. All four changed lockfiles contain only the certifi version/hash replacement. Both new artifact hashes match official PyPI metadata, and the existing platform markers and other dependency pins are preserved.

Fresh hash-locked macOS/Python 3.12 validation: editable no-deps installation and pip check pass; the full unit selection passes 2,525 tests with 20 skips; Ruff, mypy and configured Bandit pass. A new pip-audit of requirements/dev.txt reports no known vulnerabilities.

The current-head hosted technical checks have passed; the failing returned checks before this review are maintainer approval gates. Normal branch rules remain applicable. The commit carries DCO sign-off.

Hash source: https://pypi.org/pypi/certifi/2026.10.19/json

Reviewed with OpenAI Codex.

[noah-ing]

Head 4f2e7e1 now has Carlos’s current-head maintainer approval, and the 17 successful checks remain green. The required pull_request_target gate in run 39588841540 still reports its earlier “found 0” result from October 21, before that approval. Could a maintainer rerun that failed job, or advise the supported way to refresh this required status? No source or policy change is requested.

[dinakarjs]

Attempted to refresh failed maintainer-approval run 39588841540 after the current-head approval, using the failed-jobs rerun operation. GitHub returns HTTP 403 'Resource not accessible by integration'; no rerun occurred. A maintainer with Actions write access must refresh that gate. Separate new audit findings now have focused follow-up #822 (filelock/setuptools); the original certifi patch remains unchanged. No review-policy or audit exception proposed.