[andrazk]

Summary

Replace certifi 2026.1.4 with 2026.10.19 to address critical GHSA-6q48-6c7w-9gw2 (compromised emSign intermediate keys in the old bundled trust roots).

Tracking: https://linear.app/casemarkai/issue/CD-1788
Advisory: GHSA-6q48-6c7w-9gw2
Vanta: https://app.vanta.com/c/casemark/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-critical

Scope

• Only certifi changes in uv.lock; regenerate the existing requirements-dev.lock export.
• No source, manifest, Python support, SDK version, workflow, environment or credential changes.
• Based on current main after aiohttp PR [CD-1788] Patch aiohttp transport vulnerabilities #146 merged through pre-existing repository automation. That rescan closed its three aiohttp findings and exposed native Dependabot alert release: 0.15.0 #43 for certifi.

Validation

• uv lock --check; frozen all-extras Python 3.10 install.
• 472 offline client/utility/transform tests pass; 2 existing skips.
• Wheel and sdist builds pass; patched CA bundle loads in the standard SSL context.
• Exact lock inventory assertion confirms certifi is the only changed package.
• Paired generator lock-floor guard and regression coverage: https://github.com/CaseMark/casedotdev-mono/pull/2810 (draft).
• Matching staging fix is included in https://github.com/CaseMark/casedev-python-staging/pull/43.

Human-controlled rollout

DRAFT intentionally: this repository has an existing workflow that enables auto-merge for admin-authored opened/reopened PRs. Owner decision https://linear.app/casemarkai/issue/CD-1915 tracks a safe manual-remediation opt-out. This agent must not merge, approve, enable auto-merge or request a reviewer to merge. No release publishing or deployment is performed by this work. Require independent current-head review, CI and human merge/release decision; preserve the change in reviewed Stainless seal-back before regeneration. GitHub closure and Vanta ingestion remain separate verification gates.

[thurgood-bot]

DB Cooper Database Review

Risk: very-low

Lockfile-only certifi bump (2026.1.4 to 2026.10.19) in uv.lock and requirements-dev.lock with no source, schema, migration, or query changes; no database risk. Verified repo is a Python API client with no DB layer, schema definition, or migration files.

No database risks found. Migrations and DB-impacting changes look safe.

---

DB review by DB Cooper | Re-run with /dbreview

[thurgood-bot]

Judicial Review

Risk: high

Bumps certifi 2026.1.4 to 2026.10.19 in uv.lock and requirements-dev.lock to remove compromised emSign trust roots (GHSA-6q48-6c7w-9gw2). Scope matches description with no source changes; TLS trust change is security-sensitive and requires human merge/CI verification.

No significant issues found. This code is cleared to ship.

---

Legal-Grade review by Thurgood | Re-review with /review

---

Verdict: Human review required · risk high

[thurgood-bot]

Thurgood verdict: Human review required

Risk: high

Bumps certifi 2026.1.4 to 2026.10.19 in uv.lock and requirements-dev.lock to remove compromised emSign trust roots (GHSA-6q48-6c7w-9gw2). Scope matches description with no source changes; TLS trust change is security-sensitive and requires human merge/CI verification.

Lockfile-only certifi bump (2026.1.4 to 2026.10.19) in uv.lock and requirements-dev.lock with no source, schema, migration, or query changes; no database risk. Verified repo is a Python API client with no DB layer, schema definition, or migration files.

• Draft PRs are not auto-approved

Thurgood is not auto-approving this pull request.