[hasheddan]

Updates certifi to 2026.10.19 to address issue with compromised intermediate CA certificates.

See
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE?pli=1 for more information.

NOTE: keeping poetry and uv support for the time-being given that documentation still uses poetry everywhere.

---

Note

Medium Risk
Updates the trusted CA bundle used for HTTPS verification, which is security-critical but is the intended remediation for compromised intermediates.

Overview
Bumps the Mozilla CA bundle by pinning certifi to 2026.10.19 in both poetry.lock and uv.lock, addressing recently disclosed compromised intermediate CA certificates (see Mozilla dev-security-policy thread).

The lockfile refresh also carries incidental resolver churn: Poetry lock header moves to 2.5.1, uv.lock revision increments, tomli dev dependency markers tighten for Python 3.10, and uv.lock metadata reflects raised minimums for cbor2 (≥5.9.0) and idna (≥3.15) plus a simplified exceptiongroup → typing-extensions marker.

^{Reviewed by Cursor Bugbot for commit ebc3b6e. Bugbot is set up for automated code reviews on this repo. Configure here.}