security(deps): patch certifi GHSA-6q48-6c7w-9gw2 #2458

Resolution — verified security merge

Resolved by PR #2456, merge e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52, approved head 9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b. Current execution receipt records the exact mutation, evidence, limitations and post-merge check state. The findings below are the original issue history; they do not describe current main.

Security finding

• Advisory: GHSA-6q48-6c7w-9gw2
• Package: certifi
• Current lock: 2026.7.22
• Fixed release: 2026.10.19
• Severity: Critical, CVSS 9.1
• Dependency type: transitive (via httpx, requests, and other packages; no direct manifest requirement)
• Published/reviewed: 2026-10-20

GitHub's dependency-review gate surfaced this finding on PR #2456 because that PR touches uv.lock.

Acceptance criteria

• Update only the certifi lock entry to 2026.10.19 using PyPI-published hashes and provenance.
• uv lock --check passes.
• Locked environment imports certifi 2026.10.19.
• Targeted EventRelay AI SDK tests and Ruff checks pass.
• PR dependency-review and security gates pass.
• No production deployment or merge occurs without applicable authorization.

Evidence

• Advisory: GHSA-6q48-6c7w-9gw2
• Release: https://pypi.org/project/certifi/2026.10.19/