[aikido-autofix]

Upgrade pypi-publish to remove compromised emSign root CA certificate from certifi bundle, preventing potential man-in-the-middle attacks on PyPI publishing.

✅ 1 CVE resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-5xjx-3w67-w9x9	🚨 CRITICAL	[pypa/gh-action-pypi-publish] A removed root CA certificate from the bundled trust store breaks TLS verification for Sigstore, compromising Trusted Publishing and Digital Attestations functionality. This could allow man-in-the-middle attacks or prevent secure package publishing operations.

🔗 Related Tasks

• https://linear.app/wave-av/issue/WAVE-32757/aikido-fix-critical-issue-in-pypagh-action-pypi-publish-via-minor
• https://linear.app/wave-av/issue/WAVE-32613/minor-upgrade-for-pypagh-action-pypi-publish-sdk-python

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: cf2f4793-cb3c-448b-9ed7-e6b8e11e94e5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts