tree 27818700cf022a22ca37d177b5034e5a126d1a74
parent 91c9a84a9cb565d306d272352fffb814a6439d40
author Richard Levasseur <richardlev@gmail.com> 1792798838 -0700
committer GitHub <noreply@github.com> 1792798838 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJq2/B2CRC1aQ7uu5UhlAAA8kUQAC8CTDFlU5L8xewhlL/PsEm8
 bmMY2o53stnkkwLMJqzNUQ395kIY22GCZSqxOjB3cqYR8fXJ24WPf33ILw662Yr2
 HxgKyW076/OkQaUhNkc9EjzCSMdEBzU1uZ13XKq8N6saIPhDAR+UvMQU8snKUKKv
 QnbNkMzkYrOPS/Q+BGpqA03JHeEdxTedWtUzyzLvBRYi2lkSBkHRjjY+3NMg22MK
 NTl9mUJy7pmauSZge0QGLpx2WvjST55Y9vxYRYHI/Rs3EfpDnjGg7PIoc98gHkdI
 74gC+Sj+7H1bXucgkvRr3XqSkRKIiWT4dDUWWGhGmKSX+z0qZzD8rXD290KHPHKp
 o6u3U494dz/WmFqXsmgnKFfwvBmDZTVABaE/4ZKd2AeXtPZ3cFEQJRxiA4rjoFEJ
 vfGhf/Mb6GBTR6OUj60UHX8iunIXFoMm9D5MoE6oxVP4Gqul6D1zFc9q0xC0JeW9
 WUm0+JK5eU4g73k94BQh1f5a7zeDXH/o2JxJZNUIh3jGbMyTBbIpgtMTLSfxWx1K
 NjKeyEgBmVYtxUM/9VgRbvD+PHm+PYKE+GwsGJIYmTnwLswZHiNiKPyxyAhGTv5H
 F5m0l7Ho/0YSPOXIkJwlAqQDx8idDchpTBmMp39ibDqlD/KX05fJm4O5d83l51yz
 yfFWqeoZ7ucHCtWU5Dio
 =uWXx
 -----END PGP SIGNATURE-----
 

build(deps): bump certifi in dev uv.lock files (#4337)

Dependabot flagged certifi < 2026.10.19 (GHSA-6q48-6c7w-9gw2): it
bundles emSign root CAs whose intermediate CA keys were compromised.
Dependabot's update (#4297) did not touch the uv.lock files, so the
dev tooling locks still pinned vulnerable versions.

Relock `dev/uv.lock` and `sphinxdocs/dev/uv.lock` with
`uv lock --upgrade-package certifi`, leaving other pins alone. Both
use the root module's pinned uv and hermetic Python: the sphinxdocs
module's own `//dev:uv_lock.update` target cannot run because that
module registers no uv toolchain. Relocking the sphinxdocs lock also
drops its stale Python 3.9 forks and renames the virtual root project
to match its pyproject.toml.

Fixes Dependabot alerts 912 and 930:
https://github.com/bazel-contrib/rules_python/security/dependabot/912
https://github.com/bazel-contrib/rules_python/security/dependabot/930