From 0a065b7209bfb1f62b47e4326bac7c22f0287558 Mon Sep 17 00:00:00 2001
From: Giles Knap <giles.knap@diamond.ac.uk>
Date: Fri, 6 Nov 2026 10:46:36 +0000
Subject: [PATCH] Bump certifi to 2026.10.23 for emSign CA compromise

Fixes GHSA-6q48-6c7w-9gw2 (eMudhra emSign ECC Root CA - G3 compromised
intermediate keys). Only the certifi entry in Pipfile.lock is changed;
version and sha256 hashes taken from PyPI. GHSA-hq85-5cpj-mr62 (uv) does
not apply: this repo does not use uv.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uybqz86W312JcHngTnM126
---
 Pipfile.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Pipfile.lock b/Pipfile.lock
index a7ccccd7..bee3d86d 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -286,11 +286,11 @@
         },
         "certifi": {
             "hashes": [
-                "sha256:9943707519e4add1115f44c2bc244f782c0249876bf51b6599fee1ffbedd685c",
-                "sha256:ac726dd470482006e014ad384921ed6438c457018f4b3d204aea4281258b2120"
+                "sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd",
+                "sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1"
             ],
             "markers": "python_version >= '3.7'",
-            "version": "==2026.1.4"
+            "version": "==2026.10.23"
         },
         "charset-normalizer": {
             "hashes": [