[stevejalim]

One-line summary

Bump certifi, uv and Debian ca-certificates to drop the compromised eMudhra intermediates.

Significant changes and points to review

Eight eMudhra intermediate CA private keys were recoverable from their certificates
(announced 2026-10-20, see https://emudhra.we-have-a-problem.com/). Anyone with those keys can impersonate any TLS host
to a client that still trusts the chains. This bumps every trust store this repo ships or
builds with to a release that distrusts them.

• certifi 2026.7.22 to 2026.10.19 in uv.lock (runtime trust store for requests, urllib3,
  google-auth and google-cloud-storage). It is inside the 7-day exclude-newer cooldown, so
  this adds the documented per-package exemption. Remove it on or after 2026-10-28 (the release
  was uploaded 2026-10-20T02:24Z, so the window clears on the 27th) and re-lock.
• uv 0.12.17 to 0.13.4 in the Dockerfile and the two docs workflows that are kept in sync with
  it. uv fetches from PyPI with its own embedded roots. The lock was regenerated with 0.13.4,
  which is why the lock revision moves to 5 and records default-groups.
• Add ca-certificates to the builder and app-base apt-install lines so a rebuild picks up
  Debian's fixed package (20250419~deb12u2 in bookworm-security) even when the upstream
  python:3.13-slim-bookworm tag has not been rebuilt yet. Covers curl, git and the system
  store.
• node:24-slim and CI node-version: 24 float, so a rebuild gets Node 24.22.1 for free.

Issue / Bugzilla link

Mozilla Bugzilla #2083449 (incident report)

Testing

uv lock --check passes. Image build in CI exercises the Dockerfile changes. After deploy,
curl https://dv-g3b-emudhra.we-have-a-problem.com/ from the container should fail with a
certificate error.

[Copilot]

🔵 Needs a closer look

Security remediation needs confirmation that rebuilt images contain the fixed trust stores and reject the compromised certificate chains.

No open issues 🎉

What changed in this PR

Updates Bedrock’s Python and container trust stores to address the reported eMudhra CA compromise.

Changes:

• Updates certifi with a temporary release-cooldown exemption.
• Synchronizes uv versions across Docker and documentation workflows.
• Explicitly installs Debian CA certificates in builder and runtime images.

File	Description
uv.lock	Updates certifi and lockfile metadata.
pyproject.toml	Temporarily exempts certifi from the cooldown.
Dockerfile	Updates uv and installs CA certificates.
.github/​workflows/​pull_request_test_docs.yml	Aligns uv for documentation testing.
.github/​workflows/​publish_docs.yml	Aligns uv for documentation publishing.

_{Review effort: Balanced}

[stevejalim]

R+