)]}'
{
  "commit": "7e168ea606e63eafbac260e48405a9e355c0cfa1",
  "tree": "27818700cf022a22ca37d177b5034e5a126d1a74",
  "parents": [
    "91c9a84a9cb565d306d272352fffb814a6439d40"
  ],
  "author": {
    "name": "Richard Levasseur",
    "email": "richardlev@gmail.com",
    "time": "Fri Oct 23 16:40:38 2026 -0700"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Fri Oct 23 16:40:38 2026 -0700"
  },
  "message": "build(deps): bump certifi in dev uv.lock files (#4337)\n\nDependabot flagged certifi \u003c 2026.10.19 (GHSA-6q48-6c7w-9gw2): it\nbundles emSign root CAs whose intermediate CA keys were compromised.\nDependabot\u0027s update (#4297) did not touch the uv.lock files, so the\ndev tooling locks still pinned vulnerable versions.\n\nRelock `dev/uv.lock` and `sphinxdocs/dev/uv.lock` with\n`uv lock --upgrade-package certifi`, leaving other pins alone. Both\nuse the root module\u0027s pinned uv and hermetic Python: the sphinxdocs\nmodule\u0027s own `//dev:uv_lock.update` target cannot run because that\nmodule registers no uv toolchain. Relocking the sphinxdocs lock also\ndrops its stale Python 3.9 forks and renames the virtual root project\nto match its pyproject.toml.\n\nFixes Dependabot alerts 912 and 930:\nhttps://github.com/bazel-contrib/rules_python/security/dependabot/912\nhttps://github.com/bazel-contrib/rules_python/security/dependabot/930",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a08329a7c3f22c74dd748e27dfc0901632aa47bc",
      "old_mode": 33188,
      "old_path": "dev/uv.lock",
      "new_id": "903729576b2847264b6c4e1510a611e575246d60",
      "new_mode": 33188,
      "new_path": "dev/uv.lock"
    },
    {
      "type": "modify",
      "old_id": "5461bc7c9fa4eec364651205630ed663ef1acd8a",
      "old_mode": 33188,
      "old_path": "sphinxdocs/dev/uv.lock",
      "new_id": "13535a31efc176bb28eb37080b20a1542a763934",
      "new_mode": 33188,
      "new_path": "sphinxdocs/dev/uv.lock"
    }
  ]
}