[TechnoFinch]

Bumps certifi to 2026.10.19, which removes the emSign ECC Root CA - G3 following the compromise of eight eMudhra intermediate CA keys (CVE-2026-111943).

Only the affected pins changed. Takes effect after rebuild + redeploy; container images should also pick up the updated OS ca-certificates package.

[broly-code-security-scanner]

Broly Security Scan

Warning

Latest baseline snapshot is stale. Broly is running in PR-only fallback mode until the next scheduled baseline refreshes. This does not block the PR.

Note

Summary

1 actionable finding(s) in this PR
2 total in scan · 1 dismissed false positive

• 🟡 1 medium

Main table: 1 shown, 0 omitted of 1 actionable finding(s) above the reporting threshold. See the repository Security tab for the full set.

No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟡 MEDIUM	SCA	pygments@2.16.1 — 2 vulnerabilities (worst: PYSEC-2026-2987) → fixed in 2.20.0	tools/devctr/poetry.lock:1	d7	🔺 TRUE_POSITIVE · Confidence: HIGH

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d7 · 🟡 MEDIUM   · tools/devctr/poetry.lock:1 · pygments@2.16.1 — 2 vulnerabilities (worst: PYSEC-2026-2987)

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Attack Hypotheses · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.