[aaronphifer]

Summary

Upgrade the CI lock from certifi==2026.6.17 to certifi==2026.10.19 to address GHSA-6q48-6c7w-9gw2.

Scope

The change is limited to the regression workflow’s Python dependency lock.

Validation

• Installed the updated lock on Python 3.12. pip check passed and the dashboard runtime lock resolved in a dry run.
• OpenSSL trusted the affected emSign root with the old wheel and rejected it with the patched wheel. The three unaffected emSign roots matched byte for byte.
• All 555 Python tests and 161 JavaScript tests passed. The gold-set gate, SPC regressions, Python compilation, and git diff --check also passed.
• Docker was unavailable for local Compose and build checks.

Security and operations

The regression workflow picks up the patched pin on its next dependency install. This change requires no application migration or redeployment.

Files changed

• tests/requirements-ci.txt pins the patched certificate bundle.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T12:46:32.239007Z	949219c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.