[noah-ing]

Summary

• Update certifi from 2026.7.22 to 2026.10.19 with published PyPI hashes in ten active requirements locks, including Sentinel runtime.
• Update the released UCP uv bootstrap from 0.12.5 to 0.13.4 with release hashes, regenerate its uv.lock to use certifi 2026.10.19, and align the host-development README with the patched uv version.

Validation

• All ten requirements locks passed Linux-target, hash-locked uv dry runs.
• The released UCP uv lock passed uv lock --check; managed Python 3.12 uv sync and its offline smoke suite passed (229 tests, Ruff, mypy, Bandit).
• The changed certifi wheel and source hashes match the published PyPI artifacts.
• On head 787c5ad, 42 hosted checks passed, including fuzzing. Three checks failed: the expected maintainer approval gate; the link checker receiving HTTP 451 from an unchanged nobulex URL; and the WCM example job, which reproduces on the unchanged base after dependency resolution drift. The separate fix in fix(ci): declare model-signing OpenSSL dependency #360 passed that WCM job on its own exact head.

Scope

This updates the bundled CA copies used by these lockfiles. System CA bundles in pinned Docker base images need separate verification and rebuild before claiming container-wide protection; the WCM image work is in draft agentrust-io/weight-custody-manifest#221. Maintainer review remains required.

References: GHSA-6q48-6c7w-9gw2 and GHSA-hq85-5cpj-mr62

[dinakarjs]

Reviewed exact head 787c5ad. Checked all changed lock paths: certifi hashes match official PyPI 2026.10.19 metadata; universal markers are retained. The released-UCP uv bootstrap hashes match official uv 0.13.4 Linux wheels; its lock changes only certifi plus the lock revision. Hash-required Python 3.11 Sentinel resolution succeeds. Hosted Sentinel, adapters, released-UCP, validation and lint checks succeed. Overall Examples and documentation checks remain failures; they must be resolved independently rather than treated as green. Overlapping #361 drops cross-version markers and fails Python 3.11, so this is the preferable marker-preserving dependency repair. No blocking source finding.

[carloshvp]

Reviewed exact head 787c5addef9bc1e8adb2d276887e75d83b62b210 in an isolated checkout.

Approving the certificate-bundle updates and corresponding uv bootstrap refresh. All ten changed requirements-style lockfiles preserve their non-certifi pins and universal markers; the new certifi hashes match official PyPI metadata. In the UCP lock, the package delta is confined to certifi, alongside the format revision. The uv 0.13.4 bootstrap hashes also match official PyPI metadata.

Independent macOS/Python 3.12 validation: a fresh hash-locked Sentinel environment passes pip check and all 17 integration tests. uv 0.13.4 accepts the committed UCP lock with lock --check (76 packages). Whitespace checks pass. I did not reproduce the Linux container build or every supported platform locally.

The failed hosted links job identifies the inherited Nobulex 451, and the WCM job reports the inherited missing OpenSSL import; #357 and #362 address those separately. A complete current successful hosted run and normal branch gates remain required. The commit carries DCO sign-off.

Hash sources: https://pypi.org/pypi/certifi/2026.10.19/json and https://pypi.org/pypi/uv/0.13.4/json

Reviewed with OpenAI Codex.