Repository navigation
Bump certifi from 2026.7.22 to 2026.10.19 - #2540
Merged
Merged
Conversation
Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.7.22 to 2026.10.19. - [Commits](certifi/python-certifi@2026.07.22...2026.10.19) --- updated-dependencies: - dependency-name: certifi dependency-version: 2026.10.19 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Aggregate impact on certified data: passBase Checks: 0 broken by this change, 1 failing on both sides, 0 fixed. Moves flagged for review: 0 (thresholds in Notes
Moves flagged for reviewNone. Spending by benefit and service
Caseloads
Standard reform costings (change in gov_balance)
Standard reforms: change in each reform's target
Household net income by decileNo household's net income changes in any year. No change in any year: receipts by tax head; government balance, each component counted once; model totals; household income totals; population; poverty rates; people in poverty; inequality; mean household net income in each side's own deciles. Checks failing on both base and head (1)
Counted-once checkEach of 84 components was raised by £1 per unit in 2026-27, and every head of its totals was read household by household: its own head must rise by exactly £1, no other tax head may move, no other benefit may rise, and the model's own total must move by what its heads moved. A head that breaks a rule is measured again twice: with every other head held at its baseline value, and with every other head held at its value after the first £1 while the component rises again. It fails where either still shows the response. 0 failed; 0 were skipped. Provenance
Dataset: Runtime differences:
Receipts by tax head: head levels
Spending by benefit and service: head levels
Caseloads: head levels
Government balance, each component counted once: head levels
Model totals: head levels
Household income totals: head levels
Population: head levels
Poverty rates: head levels
People in poverty: head levels
Inequality: head levels
Mean household net income in each side's own deciles: head levels
Standard reform costings (change in gov_balance): head levels
Standard reforms: change in each reform's target: head levels
|
juaristi22
requested changes
Oct 22, 2026
juaristi22
left a comment
juaristi22
left a comment
Collaborator
There was a problem hiding this comment.
Review status: COMPLETE
Review severity: REQUEST_CHANGES
Reviewed head: f19c6e4
The certifi lock entries match the published release metadata. Offline lock validation and the current-head functional CI pass. Two repository completion gates remain:
- C1 — Add a Towncrier fragment. This PR changes only
uv.lock. The repository PR requirements require a fragment for every PR; the release workflow also does not trigger onuv.lockalone. A shortchangelog.d/2540.changed.mdwould cover this dependency update. - C2 — Resolve the Aggregate impact CI hold before merging. The current run skips data access for Dependabot, then fails with
No module named pe_uk_aggregate_impact. It produces no comparison. This is an existing workflow problem; it does not demonstrate a certifi regression. Although GitHub branch protection requires only the passingTest / ResultandLintcontexts, the shared contribution guide requires all CI jobs to pass. Obtain a successful current-head run or a maintainer resolution of that documented gate.
Validation: published PyPI URLs, SHA-256 metadata and sizes match the lock; supported Python versions remain compatible; uv lock --check --offline --no-python-downloads and git diff --check pass. Model tests were not run locally; frozen-lock YAML/Python CI passed at this exact head.
certifi 2026.10.19 removes the "emSign ECC Root CA - G3" root from its bundled cacert.pem. The fragment also makes the merge to main start the release workflow, which runs only on changes to changelog.d/** or pyproject.toml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
|
UK hub note: this bump closes a critical open Dependabot alert on main (alert 67: certifi before 2026.10.19 bundles emSign root CAs with compromised intermediate keys; patched in 2026.10.19). @anth-volk's |
juaristi22
approved these changes
Oct 22, 2026
juaristi22
left a comment
juaristi22
left a comment
Collaborator
There was a problem hiding this comment.
Review status: COMPLETE
Review severity: APPROVE
Reviewed head: bfbe094
C1 and C2 are resolved. The required Towncrier fragment is present and correctly configured. Its emSign ECC Root CA - G3 removal statement matches the preserved primary certifi bundle comparison.
The entire incremental diff is that one fragment; uv.lock is byte-identical to the previously reviewed head. The original package/hash/compatibility and offline lock checks remain applicable. No model test, installation or dependency sync was repeated for this text-only update.
Fresh exact-head evidence confirms successful Code changes and Aggregate impact runs, with all 16 latest CI contexts passing. This clears the earlier completion hold. The historical Aggregate failure was an unchanged Dependabot workflow issue, not a certifi regression.
No open findings or material evidence gaps. Landing remains with the UK hub.
main's version bumps rewrote uv.lock after Dependabot built this branch, so the PR conflicted in the merge queue. Take main's lock and re-apply only certifi 2026.7.22 -> 2026.10.19 (uv lock --upgrade-package certifi==2026.10.19), the version reviewed and approved. Against main the lock now changes only certifi's version and hashes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
|
Merged by the UK hub (Claude session 8e19f9d5) at head
|
This was referenced Oct 25, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps certifi from 2026.7.22 to 2026.10.19.
Commits
662df63Restore unaffected emSign roots (#439) (#440)5cb238cRemove emsign (#437)69494a7Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)029c7b0Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)9d0a8f1Add support for Python 3.15 (#432)db472abBump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.