[jtroup]

ENG-9343

what

Require certifi 2026.10.19 or later. Earlier certifi releases trust
the compromised eMudhra CA, and httpx uses certifi as its default CA
bundle. A new minimum in [project].dependencies makes installers
pick up the fix. uv.lock alone does not reach anyone who installs
from PyPI.

Release 2026.10.23. This is the first release since 2026.04.0, so the
tag publishes every change merged since then, not only this one. The
version is the release date, as in stacklet-admin. NEWS.md moves the
pending entries under an October 23, 2026 heading. It adds
customer-facing entries for the earlier changes that had none, and
rewrites the dataset export entry to match. Changes that only matter
when platform embeds the server stay out of NEWS.md.

Upgrade cryptography, platformdirs, pyjwt and starlette to pick up
CVE fixes. We do not import them, but each now has a minimum in
[project].dependencies for the same reason as certifi. fastmcp gets
a minimum of 3.3.1, the security release this version ships, and a
cap below 4. fastmcp 4 removes fastmcp.tools.tool, so a fresh
install of 2026.04.0 gets fastmcp 4.1.0 and fails at import.

For development, update uv to 0.13.4 in .tool-versions and pip to
26.2.2, with a minimum for pip in the dev group. The new uv moves the
lockfile format from revision 3 to revision 5. uv 0.11.13 still
accepts it, and uv lock --check passes with it.

PyPI received both the certifi and the pip release on 2026-10-20.
That is inside our 7-day exclude-newer window, so uv lock refuses
them. A per-package exclude-newer-package cutoff of 2026-10-21
admits these two releases now. All other packages still need 7 days
on PyPI before uv accepts them. The cutoff also refuses any certifi or
pip release after 2026-10-21 until we remove it. The comment next to
it says to do that after 2026-10-27, when the 7-day window covers
these releases.

The typos hook reads "certifi" as a misspelling, so
[tool.typos] now accepts it.

why

The epic ENG-9331 has the detail on the eMudhra CA compromise and the
fixed version of each tool.

testing

This change relies on the existing suite running in CI with uv 0.13.4.
CI reads that version from .tool-versions.

I built the wheel and installed it over 2026.04.0 in a new venv that
held the old certifi, cryptography, fastmcp, platformdirs, pyjwt and
starlette. The install raised each one to its new minimum and chose
fastmcp 3.4.8. Over stdio against a QA instance, the docs, GraphQL
and AssetDB tools all returned results. A bad GraphQL field and a
missing docs page each returned the expected guidance.

docs

NEWS.md has the release notes under October 23, 2026.

---

🤖 Generated with Claude Code

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant PyPI as PyPI Registry
    participant UV as uv Package Manager
    participant Lock as uv.lock
    participant Venv as Virtual Environment
    participant CI as CI Pipeline

    Note over Dev,PyPI: NEW: Dependency Resolution with Security Pins
    
    Dev->>PyPI: Request certifi >= 2026.10.19
    Dev->>PyPI: Request cryptography >= 50.0.2
    Dev->>PyPI: Request fastmcp >= 3.3.1,<4
    Dev->>PyPI: Request platformdirs >= 4.13
    Dev->>PyPI: Request pyjwt >= 2.15.1
    Dev->>PyPI: Request starlette >= 1.8
    
    Note over UV,Lock: NEW: uv 0.13.4 with lockfile format v5
    
    UV->>PyPI: Install with exclude-newer = "7 days"
    alt Newly released packages (certifi, pip)
        Note over UV: CHANGED: Use per-package cutoff 2026-10-21
        UV->>PyPI: Accept certifi and pip releases
    else Other packages
        UV->>PyPI: Apply 7-day wait window
    end
    
    alt Package versions satisfy minimums
        UV->>Venv: Install compatible versions
        UV->>Lock: Generate lock file (revision 5)
    else Version conflict
        UV->>Dev: Resolution error
    end
    
    CI->>UV: Read version from .tool-versions (0.13.4)
    CI->>Lock: uv lock --check
    Lock-->>CI: Verified (compatible with uv 0.11.13)
    
    CI->>Venv: Run test suite
    Venv-->>CI: All tests pass
    
    Note over Dev,Venv: CHANGED: Release version 2026.10.23

Loading

_{Re-trigger cubic}