[jtroup]

what

Upgrade certifi to 2026.10.19 to fix GHSA-6q48-6c7w-9gw2.

Add a 7-day exclude-newer window to [tool.uv]. uv now refuses
package versions uploaded less than 7 days ago. certifi is exempt
from the window so we can take the fix now. A comment marks the
exemption as temporary, for removal on the next certifi upgrade.

The relative exclude-newer value and the per-package exemption need
a newer uv, so .tool-versions moves uv to 0.12.23. The lockfile
refresh also picks up minor upgrades of other dependencies.

why

certifi 2026.7.22 is vulnerable to GHSA-6q48-6c7w-9gw2.

The cooldown is a supply-chain defence. A compromised release that
lands on PyPI cannot enter the lockfile before maintainers and
detection tools have time to react.

testing

Relying on the existing suite against the refreshed lockfile.

docs

No docs needed.

---

🤖 Generated with Claude Code

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant UV as uv (0.12.23)
    participant PyPI as PyPI Registry
    participant Lock as uv.lock
    participant Cert as certifi Package
    participant TC as Toolchain (asdf)

    Note over Dev,TC: Dependency Resolution Flow

    Dev->>TC: Install uv 0.12.23
    TC->>TC: Read .tool-versions
    TC-->>Dev: uv ready

    Dev->>UV: uv lock (resolve deps)
    UV->>UV: Read [tool.uv] config

    alt Package is certifi
        UV->>UV: Check exclude-newer-package
        UV-->>UV: certifi exempt (temporary)
    else Other packages
        UV->>UV: Apply 7-day exclude-newer window
    end

    UV->>PyPI: Query package metadata
    PyPI-->>UV: Versions with upload dates
    UV->>UV: Filter recent (<7 days) unless exempt
    UV->>Lock: Write resolved versions
    Lock-->>UV: Updated lockfile

    Note over Dev,Lock: CI / Build Flow

    Dev->>UV: uv sync (install from lock)
    UV->>Lock: Read locked versions
    Lock-->>UV: certifi 2026.10.19 (patched)
    UV->>PyPI: Download wheels
    PyPI-->>UV: Patched certifi
    UV-->>Dev: Installed environment

    Note over UV,PyPI: Security Boundary: supply-chain cooldown blocks compromised uploads before they reach lockfile

Loading

_{Re-trigger cubic}