Skip to content

chore(deps): bump certifi from 2026.7.22 to 2026.10.19 - #20

Merged
RobbsLuo merged 1 commit into
mainfrom
dependabot/uv/certifi-2026.10.19
Oct 24, 2026
Merged

RobbsLuo merged 1 commit into
mainfrom
dependabot/uv/certifi-2026.10.19

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps certifi from 2026.7.22 to 2026.10.19.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.7.22 to 2026.10.19.
- [Commits](certifi/python-certifi@2026.07.22...2026.10.19)

---
updated-dependencies:
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 23, 2026
@RobbsLuo
RobbsLuo merged commit 6772a4f into main Oct 24, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/certifi-2026.10.19 branch October 24, 2026 16:14
@RobbsLuo

Copy link
Copy Markdown
Owner

已合并(rebase → 6772a4f),CI 四个 job 全绿(backend / frontend / compose / security)。

合并前在本机做的核对:

  • uv lock --check 通过,revision 3 → 5 与 uv 0.13.5 一致,没有多余的锁文件漂移;
  • 先 rebase 到最新 main(含 trae登录不回调 #21 的 TRAE 回调修复)再验,避免把旧 base 的结论当成新结论;
  • uv sync --frozen 装出 certifi 2026.10.19,pip-audit 无已知漏洞;
  • 全量测试 3849 passed / 覆盖率 100%,ruff + bandit -ll 干净;
  • 用新 CA 包对八个渠道实际出站主机做了 TLS 握手(12 个主机全部 OK,TLSv1.3/TLSv1.2),确认移除 emSign 根证书不影响任何上游;
  • 本机后端已重启,/health 200、/v1 请求正常。

关于 dependabot/alerts/1(certifi emSign 根证书,critical):依赖图里的 certifi 已经是 2026.10.19,但告警状态仍是 open——Dependabot 告警的自动关闭依赖它自己的扫描周期,这次合并后等了约 40 分钟还没翻状态,属于 GitHub 侧的延迟,不是代码问题。下次它重扫时会自动转 fixed;如果一直不转,可以在 Security 页手动 dismiss 成 "Vulnerable code is not actually used"(本仓库只把 certifi 当 CA 包用,不解析证书链)。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant