[dependabot]

Bumps certifi from 2026.7.22 to 2026.10.19.

Commits

• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[nerveai]

Nerve PR review · ✅ Ready to merge

A calendar-version bump of the transitive certifi dependency (pulled in by httpx, httpcore and requests), touching uv.lock only. Nerve has no custom CA handling, so its outbound HTTPS trusts this bundle by default. The new cacert.pem drops exactly one root, emSign ECC Root CA - G3 (121 → 120 certs), following Mozilla's emSign removal. Upstream partly restored the other emSign roots. No built-in Nerve endpoint chains to that root (Anthropic, OpenAI, Telegram, GitHub, Slack, Google). Only a user-configured endpoint signed by it would stop verifying. Apart from the version string, core.py and __init__.py are unchanged.

Completeness: the lockfile entry is consistent (I checked the wheel sha256 against uv.lock). There is no pyproject.toml change, no overlap with the other open uv.lock PRs (#479, #480, #487, #496, #525), and CI is green, including uv sync --locked plus the backend suite.

_{Checked: the wheel was downloaded, hash-verified and diffed against 2026.7.22 (never executed). The sandbox was not used because it runs main's deps, so CI is the runtime evidence. The branch is 4 commits behind main and mergeable · automated review by nerveai — mention @nerveai to ask a follow-up.}